Key points
- Meta states no product vulnerability or internal system breach occurred.
- Attackers accessed repositories using stolen employee credentials.
- About 1,500 people, mostly US employees, had personal data exposed.
Meta confirmed that hackers accessed its GitHub repositories using stolen employee credentials, not a software flaw. The company told SecurityWeek that its internal systems and products remained secure during the incident. The breach involved external access to code repositories rather than a compromise of Meta’s core infrastructure or applications.
In plain English
An outside group used login details from an employee to get into Meta’s GitHub accounts. They took software code and some personal information. Meta said about 1,500 people were affected. Most are employees in the United States. The company is notifying them now.
The background
SecurityWeek reported the incident on October 13. Meta detected the intrusion weeks earlier and cut off attacker access. The company brought in GitHub and law enforcement to help investigate. Business data made up 99 percent of what was taken. Personal data accounted for the remaining 1 percent.
What changes now
Meta has rotated secrets found in the affected repositories. The company implemented new controls to stop user data from being stored on GitHub. It is adding proactive scanning to catch accidental uploads. Meta is also working with internal teams to keep personal data off the platform.
Who needs to act first
Teams usually prioritize isolating compromised accounts immediately after detection. Verify all active sessions and force password resets for affected users. Check repository permissions to ensure only necessary staff have write access. Review audit logs for unusual download patterns or credential usage. Rotate any API keys or secrets exposed in code commits. Monitor for further unauthorized access attempts.
What to do and how to stay safe: Meta
- Check if your email domain matches Meta employees to see if you were notified.
- Review your GitHub accounts for unusual login activity or authorized apps.
- Ensure you use unique passwords for professional code hosting services.
- Enable multi-factor authentication on all developer and administrative accounts.
Step-by-step guide: How Passkeys Work: The Cryptographic Mechanics Behind Passwordless Login
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Was there a software bug that caused this?
No, Meta stated this was not a vulnerability in any product.
How did the hackers get in?
They used stolen credentials from a Meta employee.
What data was stolen?
Mostly software code, with limited personal data on about 1,500 people.
