Meta says hackers used stolen login to take code from its GitHub repositories

Meta is notifying roughly 1,500 people after an outside group used an employee's stolen credentials to get into some of the company's GitHub code repositories, according to SecurityWeek, which first reported the company's disclosure on Oct. 13.

Most of those affected are Meta employees in the United States, SecurityWeek reported. Notifications began going out Tuesday.

What was taken

According to SecurityWeek and Cybernews, Meta said:

• About 99% of the data taken was business data, mainly software code for some of its products.
• The remaining 1% was personal information. Meta has not said what kinds.
• The personal data had been placed in the repositories by mistake, in violation of company policy, and much of what looked like personal data was synthetic or anonymized test data.

A Meta spokesperson told SecurityWeek the incident was "not a vulnerability in any Meta product" and that the company's internal systems were not breached. Meta also said it found no evidence the attackers were specifically targeting its data.

Response

Meta said it detected the intrusion a few weeks before notifying people, cut off the attackers' access, and brought in GitHub and law enforcement. It has rotated secrets found in the affected repositories, is adding scanning to catch personal data uploaded by mistake, and is offering affected people credit and dark web monitoring, the outlets reported. Meta also said it is notifying regulators, without naming them.

The company has not identified the attackers or said how the credential was stolen. Cybernews noted that the breach follows a July incident in which a flaw in Instagram's account recovery tool let hackers take over more than 20,000 accounts.