Live monitoring Updated 72-hour alert levelMajor alert Editor: Frédéric LENQUETTE
CYBERIACKCybersecurity & AI intelligence · by Frédéric LENQUETTE
CybersecurityGood to know

Meta: hackers stole code and data on 1,500 people from its GitHub repositories

Using an employee's stolen credentials, an outside group gained access to Meta's GitHub repositories. The company is notifying about 1,500 people, mostly U.S. employees, whose data was in them by mistake.

By the automated monitoring of CyberiackUnder the editorial responsibility of Frédéric LENQUETTE

2 min read

Automated publication. This article was written by artificial intelligence, then checked by a second AI model that verifies the facts against primary sources. It was published without prior human review.

Translated from French by AI. The original French article is the reference version.

AI-generated illustration

Meta is notifying about 1,500 people, mostly employees in the United States, that their personal data was affected by an intrusion into some of its GitHub repositories. The company confirmed this to SecurityWeek on October 13, the day notification letters began going out. According to Meta, an unidentified “outside group” accessed the repositories using an employee's stolen credentials. The intrusion was detected a few weeks earlier, with no precise date given.

Mostly code, but also misplaced data

According to Meta, 99% of the stolen data is corporate data, mainly the source code of its products. The remaining 1% contains personal information that should never have been there: it was placed in the repositories by mistake, in breach of internal rules. Meta did not specify what type of data is involved. A good share of the data that looks personal is reportedly test data, either fictitious or anonymized.

Meta says this is not a vulnerability in one of its products and that its internal systems were not breached. According to its investigation, conducted with GitHub, the attackers did not specifically target its data. Meta says it has notified the relevant authorities.

The measures Meta has taken

  • cutting off the attackers' access and alerting GitHub and law enforcement;
  • replacing the secrets (keys, tokens) found in the affected repositories;
  • new controls to prevent user data from being stored on GitHub, and automated scanning to spot data placed there by mistake;
  • credit and dark web monitoring offered to the people affected.

Best practices for your own repositories

The scenario is nothing exotic: a stolen credential is enough to open a code repository, which often contains far more than code. A few simple measures reduce the risk:

  • Enable secret scanning on your repositories and on their history: a key deleted from a file remains visible in older versions.
  • Ban real personal data from repositories and test datasets. If it is unavoidable, use data that is truly anonymized.
  • Require strong authentication (preferably a hardware security key) and short-lived, limited-permission access tokens.
  • Monitor for mass cloning and unusual access in the audit logs of your code platform.
  • Replace immediately all of a repository's secrets as soon as illegitimate access is suspected.

Method: article written by artificial intelligence from public sources, facts verified by a second, independent AI model, published automatically without prior human review, under the editorial responsibility of Frédéric LENQUETTE. Spotted an error? Let us know.

Share this article