Meta notifies 1,500 after GitHub code theft

Meta has begun notifying approximately 1,500 people after attackers accessed its GitHub repositories using stolen employee credentials, obtaining software code and personal information belonging largely to employees in the United States.

The company said notifications began on Tuesday, 13 October, several weeks after its security team discovered the intrusion. An outside group had used credentials stolen from an employee to enter repositories containing business information associated with Meta products.

Meta said approximately 99 per cent of the material taken was business data, principally software code, while the remaining one per cent comprised personal information. It has not identified the products concerned or disclosed the categories of personal data involved.

The company said the personal information had been placed in the repositories mistakenly, contrary to its policy against storing such material on GitHub. A substantial proportion of the material appearing to contain personal information consisted of synthetic or anonymised test data, according to Meta.

That distinction could complicate efforts by the attackers to identify genuine personal records, although the company has not established whether any authentic information has been misused. The proportion of personal data within the stolen material does not indicate how many records were genuine.

Meta said its security personnel terminated the unauthorised access after detecting the intrusion and contacted GitHub and law enforcement. It is also notifying regulators while continuing to assess the information obtained by the attackers.

The company is offering affected individuals credit monitoring and dark web monitoring services. Most people receiving notifications are employees based in the United States, although Meta has not provided a breakdown covering other countries or explained whether former employees and other individuals were included.

A Meta spokesperson said the incident did not involve a vulnerability in any Meta product and that the company’s internal systems had not been breached. The unauthorised access instead involved business information stored in GitHub repositories that could be reached through the compromised employee credentials.

The distinction limits the scope of the incident as described by Meta, but does not diminish the fact that proprietary software code was copied. The company has not disclosed how many repositories were accessed, how long the attackers retained access or the volume of code removed.

Meta said its investigation with GitHub had so far produced no indication that the attackers specifically targeted the company. The identity of the group, its motivation and the circumstances under which the employee’s credentials were stolen have not been established.

There has also been no company disclosure identifying the method used to obtain the credentials or detailing the authentication protections applied to the affected repositories before the intrusion. Such information would help clarify how an external group gained access through a legitimate employee account.

Following the discovery, Meta rotated secrets identified within the affected repositories. These can include credentials or other sensitive technical values used by software systems, although the company has not specified which types were found or whether they had been exploited.

Meta also said it strengthened product security to address risks arising from the exposure of its business information. It has not announced evidence that the stolen code was used to compromise products or gain entry to additional systems.

The company is working with teams that use GitHub to prevent personal information from being stored in code repositories. Additional safeguards include proactive scanning intended to identify user data uploaded inadvertently, providing another opportunity to detect material that should not be present.

GitHub repositories are commonly used to manage software development, including source files and changes made by authorised contributors. Access to private repositories can expose material beyond the code itself when developers mistakenly include credentials, operational information or personal records.

The incident illustrates a security exposure involving authorised accounts rather than an identified software defect. Meta’s account indicates that possession of stolen credentials enabled outsiders to retrieve material from repositories without breaching the company’s wider internal infrastructure.

The company has not announced a definitive figure for the number of authentic personal records taken, nor has it specified the regulatory jurisdictions receiving notifications. Its assessment of the personal information remains separate from its estimate of the overall amount of stolen business data.

Meta said it had worked with GitHub on further measures to protect the repositories and was introducing controls designed to identify accidental uploads of user information. Those measures accompany the credential changes undertaken following the discovery.