Key points
- Approximately 1,500 individuals were impacted by the intrusion into Meta’s GitHub repositories.
- The vast majority of affected people are Meta employees located in the United States.
- Hackers accessed the repositories using stolen credentials from one employee.
Meta has begun notifying roughly 1,500 individuals that their personal information was impacted after hackers accessed several of the company’s GitHub repositories. According to SecurityWeek, the intrusion was detected a few weeks ago, and notifications to those affected started being sent out on Tuesday.
The security team at Meta confirmed that an external group gained entry to the repositories by using an employee’s stolen credentials. Once inside, the attackers extracted data before Meta’s security personnel shut down their access. The company subsequently engaged GitHub and law enforcement agencies to investigate the breach and secure the compromised accounts.
Context on the stolen data
Meta stated that 99% of the data taken by the hackers was business-related software code connected to some of its products. The remaining 1% consisted of personal data that had been mistakenly added to the repositories, violating company policy. Meta did not specify the exact types of personal information involved in this small portion of the breach.
A significant portion of what appeared to be personal data was actually synthetic or anonymised test data. This means the attackers may struggle to distinguish between genuine records and dummy data. Meta does not believe the hackers were specifically targeting its data based on the investigation conducted with GitHub so far.
Who is affected
Most of the 1,500 impacted individuals are Meta employees based in the United States. A Meta spokesperson told SecurityWeek that internal systems were not breached and there was no vulnerability in any Meta product. The breach involved improper access to business data held in a GitHub repository using stolen credentials.
Meta is notifying relevant regulators about the incident. The people whose information was involved are being offered credit monitoring and dark web monitoring services to help them manage potential risks. The company emphasised that this was a limited incident affecting a small number of people.
Our take on the response
Meta rotated secrets found in the affected repositories and implemented new controls to prevent user data from being stored in GitHub. The company is working with teams that use the platform to keep user data off it. As a second line of defence, Meta is adding controls for proactive scanning to detect any user data uploaded by mistake.
What affected people can do
Teams usually advise affected individuals to monitor their financial statements and credit reports for any unauthorised activity. Users should check whether their login credentials have appeared in other known data breaches, as attackers often reuse stolen passwords. It is prudent to enable multi-factor authentication on all important accounts to add an extra layer of security. Watch for phishing emails that reference this breach, as scammers often exploit recent news to trick victims into revealing more sensitive information or downloading malware.
What to do and how to stay safe: Meta
- Rotate any passwords that may have been stored in or associated with the compromised GitHub repositories.
- Enable multi-factor authentication on all personal and professional accounts to prevent unauthorised access.
- Monitor credit reports and bank statements regularly for any signs of fraudulent activity or identity theft.
- Be cautious of unsolicited communications claiming to offer help with this breach, as these are often scams.
Step-by-step guide: Stop Credential Leaks: 3 Immediate Actions to Secure Accounts
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many people were affected by the Meta GitHub breach?
Meta is notifying roughly 1,500 people, most of whom are employees in the United States.
What kind of data was stolen in the breach?
99% of the data was business software code, and 1% was personal data, some of which was synthetic or anonymised test data.
How did the hackers gain access to the repositories?
The hackers used an employee’s stolen credentials to access the GitHub repositories.