Meta is notifying roughly 1,500 people, most of them Meta employees in the U.S., that their personal information was caught up in a breach of some of the company's GitHub repositories. An outside group got in with one employee's stolen credentials. Meta spotted the intrusion a few weeks ago, shut the access down, and brought in GitHub and law enforcement. Notifications started going out Tuesday (per SecurityWeek).
What was taken. Meta told SecurityWeek that 99% of what the attackers took was business data, meaning software code tied to some of its products. The other 1% was personal data that had been committed to the repos by mistake, against company policy. Meta hasn't said which types of personal information were involved, so PII types: Undisclosed. A significant share of what looked like personal data was actually synthetic or anonymized test data, which may make it hard for the attackers to tell real records from fake ones (per SecurityWeek).
What Meta says it wasn't. "This was not a vulnerability in any Meta product, and Meta's internal systems were not breached," a spokesperson told SecurityWeek. Based on the investigation with GitHub so far, Meta doesn't believe the group was specifically going after Meta's data. Read that as an opportunistic credential job that happened to land on a very valuable org, not a targeted operation, at least on what's public today.
Cleanup. Meta rotated secrets it found in the affected repositories, added controls to keep user data out of GitHub with proactive scanning as a second line of defense, and worked with GitHub on additional repo protections. Affected people get credit and dark web monitoring, and Meta is notifying regulators (per SecurityWeek). How the credential was stolen, whether MFA or SSO was in the path, and how many repos were touched: Undisclosed.
What we'd do this morning. One stolen employee login turned into source code plus a pile of PII nobody meant to store there. That's the SaaS blast radius problem in one sentence. If you run GitHub or GitLab at scale: pull the audit log for clone and archive-download spikes from a single identity, especially new IPs or tokens created outside your IdP. Run secret scanning across full history, not just HEAD, and rotate anything it finds, because "removed in a later commit" still means exposed. Look for personal tokens and SSH keys that never expire and kill them. Then do the boring part Meta just learned the hard way: scan repos for real customer and employee data and block it at push. Test fixtures seeded with production records are a classic way it gets there.