Image: GitHub

Meta is notifying about 1,500 people that some of their personal information was exposed after hackers broke into a number of the company's GitHub repositories, SecurityWeek reported. Most of the people affected are Meta employees in the United States.

According to Meta, an outside group got in by using one employee's stolen login details. The company says it spotted the intrusion a few weeks ago, cut off the attackers' access, and brought in GitHub and law enforcement. Notification letters started going out this week.

The bulk of what was taken was code. Meta told SecurityWeek that 99% of the stolen data was business data, mainly software code tied to some of its products. The other 1% was personal data.

That personal data should never have been there. Meta says it was added to the repositories by mistake, against its own policy on what can be stored on GitHub. The company also says a large share of what looked like personal records was actually fake or anonymized test data, which could make it harder for the attackers to tell real details from dummy ones.

Meta has not said what kinds of personal information were involved, such as whether names, addresses or ID numbers were exposed. That is the key detail affected people will want to know.

"This was not a vulnerability in any Meta product, and Meta's internal systems were not breached," a Meta spokesperson told SecurityWeek. The spokesperson said the business data was "improperly accessed using an employee's stolen credentials."

In other words, Meta says Facebook, Instagram and WhatsApp users were not hit through a flaw in those apps. The company has not said whether any regular users are among the roughly 1,500 people being notified, only that most are employees.

Meta says it has rotated the secrets it found in the affected repositories. Secrets are things like passwords, API keys and access tokens that developers sometimes leave in code, and replacing them makes any stolen copies useless. The company also says it has strengthened product security against risks from the leaked code, added new controls to keep user data off GitHub, and is adding scanning to catch personal data uploaded by mistake.

Based on its investigation with GitHub so far, Meta does not believe the attackers were specifically targeting its data. It is also notifying regulators.

People who get a letter are being offered free credit monitoring and dark web monitoring. It's worth signing up, watching bank and credit statements for unfamiliar activity, and being wary of emails or calls that mention the breach, since scammers often use real incidents as bait. Anyone who reused a work password elsewhere should change it.

The incident follows a pattern seen this year, where a single developer's access becomes the way into a much larger store of code. In May, GitHub itself confirmed that about 3,800 of its own internal repositories were stolen after an employee's device was compromised by a poisoned VS Code extension. Nothing Meta has disclosed links the two cases, but both show how one stolen login or developer tool can expose large amounts of private code.

Several questions remain open. Meta has not named the group behind the attack, explained how the employee's credentials were stolen, said whether that account used multi-factor authentication, or listed which products the stolen code belongs to. Those details are unverified until Meta shares more.