Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach

Meta is notifying roughly 1,500 people, most of them employees in the United States, that their personal information was compromised after hackers gained access to some of the company's GitHub repositories. The intrusion was detected a few weeks ago, and notifications to the affected individuals began going out on Tuesday.

How the Breach Unfolded

According to Meta, an outside group accessed the repositories using an employee's stolen credentials. The company's security team shut down the attackers' access and brought in GitHub and law enforcement to support the investigation. Meta is also notifying regulators about the incident.

The company stressed that this was not a vulnerability in any Meta product and that its internal systems were not breached. Meta business data held in a GitHub repository was improperly accessed, and that data included a small amount of personal information for a limited number of people, most of whom were Meta employees.

What the Hackers Took

Meta told SecurityWeek that 99 percent of the data the hackers took was business data, in the form of software code related to some of its products. The remaining 1 percent was personal data that had been added to the repositories by mistake. Storing it on GitHub went against company policy, according to Meta.

The company has not disclosed what types of personal information were involved. It noted that a significant portion of what appeared to be personal data was actually synthetic or anonymized test data, which may make it difficult for the attackers to distinguish genuine records from test data. Based on its investigation with GitHub so far, Meta does not believe the hackers were specifically after its data.

Remediation Steps

In response to the incident, Meta rotated secrets found in the affected repositories and hardened its product security to address risks stemming from access to its business data. The company is working with its teams that use GitHub to keep user data off the platform.

As a second line of defense, Meta is adding controls for proactive scanning to detect any user data uploaded by mistake. The people whose information was involved are being offered credit and dark web monitoring services, the company said.

Sources: Techmeme