Meta has confirmed that the hackers broke into some of the GitHub repositories, using stolen login credentials from one of their employees. This breach reportedly exposed data connected to around 1,500 people, who are mostly the staff of Meta based in the US.
The breach actually happened a few weeks back. Meta started alerting the affected employees on Tuesday. They made it clear that their internal systems and networks are untouched; the hack was confined to business data stored on GitHub, which developers rely on to manage code.
Personal data was uploaded to GitHub by mistake
Meta shared with SecurityWeek that hackers mostly accessed business info and software source code, which were about 99 per cent of the data taken. Just 1 per cent had personal information.
Turns out, personal data should not have been in those GitHub repositories at all. Meta further admitted that it was uploaded by mistake, which violated their own security guidelines.
They do not think the impact will be big, mostly because the personal data was either synthetic or anonymised- just test files, basically.
Developers often use fake information to trial software so they do not mess with real user records.
Meta says internal systems remain secure
Meta pointed out that the mix of real and test info would make things confusing for the attackers; it is not easy to tell which records are genuine. Early checks with GitHub showed the hackers probably were not targeting Meta specifically.
Meta keeps stressing that their main systems are safe, and none of their products was vulnerable. A spokesperson told SecurityWeek the break-in was due to an employee’s stolen credentials, letting hackers grab business data and a small amount of personal info related to a handful of employees.
That is a key distinction: the attack hit an external development platform, not Meta’s internal network.
Once Meta discovered what had happened, they cut off the hackers' access, reached out to GitHub’s security team, regulators, and law enforcement to investigate. They’re offering free credit monitoring and dark web detection for those affected, just in case their personal info gets misused or they face identity theft or phishing attempts.
Meta also updated their security in response—they rotated credentials in the compromised repositories and rolled out new controls to keep user data off GitHub, period. They’re coordinating with GitHub on more repository security, and they’re planning to implement scanning tools to catch accidental uploads of personal info.
Even though Meta’s core systems are still secure, this incident shows how risky it can be when employee credentials get compromised—or when sensitive information finds its way into development repositories by accident.
ALSO READ:
Meta rolls out new AI tools to detect child sexual exploitation content on Facebook, Instagram
Meta Muse AI Agent arrives on Mac with support for complex tasks: What to know?
Meta agrees to report child abuse cases to law enforcement as Centre tightens online safety measures
