Meta GitHub breach exposed code and data of 1,500 people

Hackers accessed a portion of Meta’s GitHub repositories by using credentials they stole from someone at the company. Meta stresses that the breach did not hit Meta’s consumer products or internal systems, but it did reach development environments where code lives. The bulk of the affected people are Meta employees in the United States, and Meta has begun notifying them.

The intrusion appears to have come from an outside group that exploited a stolen login to reach the code repositories. Meta found the activity, cut off the attackers, and brought in GitHub and law enforcement to help with the investigation. Notifications to affected individuals started on Oct. 13.

What was taken was a mix of files and data. About 99% consisted of business data, primarily software code for various Meta projects. Personal data accounted for roughly 1%, and Meta says that type of information should not have been in those repos. Some of what looked like personal data was actually synthetic or anonymized test data, which could make it harder for attackers to identify real records.

As a response, Meta rotated sensitive credentials found in the repos, tightened rules to prevent personal data from being stored on GitHub, and is working with GitHub on additional protections. The company is also expanding proactive scanning to catch any inadvertent data uploads in the future.

Beyond technical fixes, Meta is offering affected people credit monitoring and dark web monitoring, and regulators are being notified as required. While Meta has not published a dedicated newsroom statement, it has confirmed the core details through its communications with SecurityWeek and other channels.

For readers, the takeaway is a reminder that security isn’t just about protecting consumer services. Intrusions into developer environments can expose internal tools and, in some cases, personal data that may have slipped into code by mistake. The lesson for companies is to tighten data handling in development workflows and for employees to stay alert for security notices from their employers.

What happens next isn’t fully known yet. Meta says it will keep tightening protections and continue coordinating with GitHub and regulators. The investigation could reveal more about how personal data ended up in code repositories and what safeguards still need strengthening across similar platforms.