Hackers used an employee's stolen credentials to break into some of Meta's GitHub repositories and walked away with product source code and personal data on about 1,500 people, most of them Meta employees in the United States.
Meta confirmed the intrusion to SecurityWeek on Tuesday, 13 October 2026, the same day it began notifying the people affected.
What was taken
According to Meta, 99% of the data the attackers took was business data, in the form of software code for some of its products. The remaining 1% was personal data.
That personal data should never have been there. Meta says it was added to the repositories by mistake and that storing it on GitHub broke company policy.
Meta also says a significant share of what looked like personal data was in fact synthetic or anonymised test data. The company argues this means the attackers may struggle to tell real records from fake ones.
How it happened
Meta says an outside group got in with the stolen credentials of a single employee. The company has not said how those credentials were stolen.
The intrusion was detected a few weeks ago. Meta's security team cut off the attackers' access and brought in GitHub and law enforcement.
Based on its investigation with GitHub so far, Meta says it does not believe the attackers were going after Meta specifically.
A Meta spokesperson told SecurityWeek that "Meta's internal systems were not breached", describing the incident as improper access to business data held on GitHub rather than a flaw in any Meta product.
What Meta has not said
- Which types of personal data were exposed
- How many repositories were accessed, or which products the stolen code belongs to
- Who the attackers are
- When the intrusion began, as distinct from when it was detected
Meta's response
Meta has rotated secrets it found in the affected repositories. That means credentials or keys were stored alongside the code the attackers took.
The company says it has hardened product security against risks that could follow from exposure of its business data. It is also working with its GitHub teams to keep user data off the platform, and is adding proactive scanning to catch any that slips through.
Meta is notifying regulators. The people affected are being offered credit monitoring and dark web monitoring.
Get the ICD Newsletter
Subscribe for source-forward cyber news, OSINT notes, breach updates, and analysis. Have evidence or a lead? Send it to ICD.