Stories
Meta Notifies 1500 Users After Stolen Credentials Expose GitHub Repositories
- •Meta is contacting approximately 1,500 individuals, mostly employees based in the United States, after unauthorized access exposed company repositories on GitHub.
- •An external group gained access using compromised employee login credentials, leading to the theft of software development material and some personal information.
- •Meta stated that 99 percent of the stolen material consisted of business information and software code, while the rest was personal data uploaded in violation of internal rules.
- •The company has replaced compromised secrets such as API keys and passwords, and is introducing proactive scanning tools to prevent future accidental data uploads.
- •Affected users are being offered credit monitoring and dark web monitoring services, and relevant regulators have been notified of the incident.
Key Questions Answered
An external group obtained access through an employee's compromised login credentials. Meta confirmed that neither a product vulnerability nor a breach of its internal systems was involved.
Approximately 99 percent of the stolen material consisted of business information, including software code and product development data. A smaller quantity of personal data was also inadvertently exposed, though a substantial share of that personal information was actually synthetic or anonymized testing data.
Meta began notifying 1,500 affected individuals—mostly its own employees based in the United States—and offered them credit and dark web monitoring services. The company replaced exposed credentials like API keys and passwords, introduced proactive scanning controls to prevent personal data uploads, and notified relevant regulators.
