SecurityWeek reported on Tuesday that Meta is notifying roughly 1,500 people, mostly US employees, that their personal data was affected by a breach of some of its GitHub repositories. GitHub is a service where companies store software code. Meta said an outside group got in with an employee's stolen credentials. The company spotted the intrusion a few weeks ago. It cut off the attackers and called in GitHub and law enforcement. Meta told SecurityWeek that 99% of the stolen data was code tied to some of its products, and 1% was personal data. It is also telling regulators and offering credit and dark web monitoring to those affected.
Meta has not said what kinds of personal information were involved. It said the personal data was placed in the repositories by mistake, against company policy. It also said much of what looked like personal data was fake or anonymized test data, so the attackers may struggle to tell real records from test ones. Meta said that, going by its work with GitHub so far, it does not believe the hackers were targeting its data in particular. The sources do not say which products the code belongs to, or who the attackers are.
For teams that build and run software, the case shows how one stolen login can open a code repository. Meta said it has rotated the secrets it found in the repositories (changed the passwords and keys stored there). It is also adding scans to catch user data uploaded by mistake.