Meta Reports GitHub Breach Involving Code and Personal Data
Meta has disclosed that an outside group gained unauthorized access to some of its GitHub repositories using stolen employee credentials, impacting about 1,500 individuals mostly consisting of US employees.
Radwan AbdulhadiEditor and technology writer
Unauthorized Access via Stolen Credentials
Meta has begun notifying roughly 1,500 individuals—primarily company employees located in the United States—that their personal information and business assets were exposed following a security intrusion detected a few weeks ago. According to details shared with [SecurityWeek](https://www.securityweek.com/meta-says-hackers-took-code-personal-data-of-1500-in-github-breach/), an outside threat group managed to gain unauthorized access to several of the tech giant's GitHub repositories by leveraging an employee's stolen credentials. Further details are available from SecurityWeek in the original source material.
Upon discovering the breach, Meta’s security team quickly moved to shut down the attackers' access. The company also brought in GitHub and law enforcement agencies to assist with the ongoing investigation. Official notifications to the impacted individuals started going out on Tuesday.
Breakdown of the Stolen Data
In statements regarding the composition of the stolen material, Meta reported that 99% of the accessed data comprised business information, specifically software code related to various company products. The remaining 1% of the data involved personal information.
Meta clarified that this personal data had been added to the repositories by mistake and should not have been stored there, as it violated internal company policy. While the company has not disclosed the precise types of personal information involved, it noted that a significant portion of the files that appeared to be personal records were actually synthetic or anonymized test data. Consequently, the attackers may find it difficult to distinguish genuine records from the test data.
Scope of the Incident and Response
Based on joint investigations with GitHub thus far, Meta does not believe that the hackers targeted its data specifically. The tech giant is currently in the process of notifying relevant regulators about the incident. Furthermore, the individuals whose personal information was exposed are being provided with credit and dark web monitoring services.
A Meta spokesperson emphasized the nature of the breach, clarifying that no company products suffered from a vulnerability and that internal corporate systems remained uncompromised. The unauthorized access was strictly confined to business data held in external GitHub repositories via compromised login credentials.
Remediation and Enhanced Defenses
Following the discovery of the incident, Meta took immediate technical steps to secure its software development environment. The company rotated all secrets found within the affected repositories and hardened its overall product security posture to mitigate risks arising from the exposed business code.
In addition, Meta is actively working alongside internal teams that utilize GitHub to ensure that user data is kept off the platform entirely. As a secondary defense mechanism, the organization is introducing proactive scanning controls designed to detect and block any user data accidentally uploaded to the platform in the future.
Sources
- SecurityWeekMeta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach
Continue chronologically
Related entity coverage
Related stories
Meta Introduces NTS Support for Public Time Service
Meta has updated its public time service to support Network Time Security (NTS), bringing cryptographic authentication and verifiability to internet time synchronization.
CrowdSec Confirms Source Code Stolen in Breach
French cybersecurity firm CrowdSec reveals that approximately 300 repositories were accessed in a breach linked to the May 2026 TanStack supply chain attack.
Apple to Tighten macOS Full Disk Access Amid AI Risks
Apple is planning tighter Full Disk Access controls in macOS to address growing privacy and security risks introduced by autonomous AI agents.
Meta Patches Zero-Day Vulnerability in Muse AI Desktop App
Meta has released a security patch for its Muse macOS application after a zero-day exploit allowed attackers to hijack the AI agent’s system privileges.
