Attackers leveraged a compromised staff member's login credentials to breach Meta's GitHub repositories, according to statements the company provided to SecurityWeek. The intrusion resulted in the theft of personal data belonging to roughly 1,500 individuals, predominantly Meta employees based in the United States. The company has begun notifying affected parties as of 13 October, when SecurityWeek published Eduard Kovacs's report on the incident.
Meta's security team detected the unauthorized access weeks earlier, promptly revoked the attackers' permissions and engaged both GitHub and law enforcement authorities. A Meta spokesperson clarified the scope of the breach: "This was not a vulnerability in any Meta product, and Meta's internal systems were not breached." The company emphasized that sensitive personal information should never have been present in these repositories in the first place, as doing so violated internal policies.
What was compromised
The stolen materials consisted primarily of business assets, with proprietary software code for various Meta products representing approximately 99 percent of the breach. Personal data accounted for the remaining 1 percent of exfiltrated content.
The presence of personal information in these repositories resulted from an inadvertent upload by a team member, constituting a violation of Meta's data storage protocols. Meta has declined to specify which categories of personal data were compromised. However, the company noted that a substantial portion of what appeared to be personal records consisted of synthetic or anonymized test data, potentially making it difficult for attackers to distinguish authentic information from fabricated datasets. Based on Meta's collaborative investigation with GitHub, the company does not believe the attackers deliberately targeted its repositories.
Remediation steps underway
Meta has implemented several corrective measures in response to the breach. The company rotated all secrets discovered within the compromised repositories and strengthened its product security posture. Teams utilizing GitHub are now receiving guidance to prevent user data storage on the platform, and Meta is deploying automated scanning mechanisms to identify and flag any accidental uploads of sensitive information.
We've since rotated secrets found in the repositories, implemented new controls to prevent user data from being stored in GitHub, and worked with GitHub on additional measures to protect our repositories.
Meta spokesperson
Affected individuals are receiving complimentary credit monitoring services and dark web surveillance capabilities. Meta is also fulfilling its regulatory notification obligations. Notably, the company has not issued a formal statement through its official newsroom, with all public comments channeled through SecurityWeek. The identity of the attacking group remains undisclosed.
Broader security landscape
Meta's latest incident reflects a wider pattern of security challenges across the technology industry. The company faced another notable incident in August when its Muse Spark model compromised a legitimate organization during a security evaluation. Third-party breaches continue to create vulnerabilities for major platforms: a DriveWealth compromise last month affected Revolut users engaged in US equity trading, while an unpatched Accenture contractor system prompted FBI intervention earlier this month.
Source: The Next Web
