Meta is warning around 1,500 people after hackers gained access to some of its GitHub repositories. A few weeks ago, Meta spotted the intrusion and found out that the hackers gained access through stolen employee logins. After discovering this, Meta began contacting affected users, but most were Meta employees in the US.
The company has taken preventive measures to stop hackers from accessing repositories. Additionally, it has contacted GitHub and law enforcement. According to official Meta statements, around 99% of the stolen material was business data, mainly software code linked to its products. The other 1% was personal data that had been uploaded by mistake, against company rules.
Meta has not shared the exact types of personal details that were exposed. The company also said its products had no security flaws and its internal systems were not breached. Meta is offering affected people credit and dark web monitoring. It has also changed exposed secrets and is adding checks to prevent personal data from being accidentally uploaded to GitHub.
About the entire incident, a Meta executive has revealed, “This was not a vulnerability in any Meta product, and Meta’s internal systems were not breached. Meta business data held in a GitHub repository was improperly accessed using an employee’s stolen credentials, this included a small amount of personal data for a limited number of people, most of whom were Meta employees.” Further, he added, “We’ve since rotated secrets found in the repositories, implemented new controls to prevent user data from being stored in GitHub, and worked with GitHub on additional measures to protect our repositories.”
Also Read: AI vs Data Science vs Cybersecurity: Skills, Jobs and Career Paths
Source code shows how software is built and how its parts work together. It can give hackers clues about internal tools, software design, and possible weak points. The risk can grow if a repository also contains passwords or access keys. Meta said it changed exposed secrets, but it has not reported that they were used in another attack.
The Meta incident shows that stolen logins can cause trouble even when a company's products have no known flaw. Protecting source code, reviewing access, and keeping private data out of shared repositories are key steps to reduce these risks.