Meta GitHub Breach: Hackers Steal Code, Data of 1,500

Meta is notifying about 1,500 people, most of them employees in the United States, that their personal information was exposed after an outside group used an employee’s stolen credentials to get into some of the company’s GitHub repositories and take software code tied to Meta products. The company disclosed the incident to SecurityWeek, the same day notifications began going out.

Meta detected the intrusion a few weeks before the disclosure but has not given an exact date. Its security team cut off the attackers’ access and brought in GitHub and law enforcement, according to the company.

Almost all of what the attackers took was business data. Meta told SecurityWeek that 99% of the stolen material was software code related to some of its products. The other 1% was personal data, which had been committed to the repositories by mistake. Storing it on GitHub broke Meta’s own policy.

Meta has not said what kinds of personal information were involved. It did say that a large share of the records that appeared to be personal data were actually synthetic or anonymized test data. As a result, the attackers may not be able to easily tell real records apart from fake ones.

Based on its investigation with GitHub so far, Meta does not believe the group was specifically targeting its data. The company has not named the attackers, said how the employee’s credentials were stolen, or said whether the account was protected by multi-factor authentication.

A Meta spokesperson told SecurityWeek that “this was not a vulnerability in any Meta product.” The spokesperson also said Meta’s internal systems were not breached. According to Meta’s account, the incident was limited to business data in a GitHub repository accessed using a stolen login. That data included a small amount of personal information about a limited number of people, most of whom were employees.

That distinction rests on where the code was stored. The repositories sat on GitHub rather than within Meta’s own infrastructure, yet they contained product code and secrets that the company has since had to replace.

Those secrets are credentials such as API keys, access tokens, and passwords that developers sometimes leave in code. Meta says it has rotated every secret it found in the affected repositories, which makes the stolen copies useless. It has also hardened product security against the risks created by outsiders now holding its business data.

Meta is also working with its internal teams that use GitHub to keep user data entirely off the platform. As a second line of defense, it is adding proactive scanning to catch personal data that is uploaded by mistake. The company says it has also worked with GitHub on additional protections for its repositories.

People whose information was involved are being offered credit monitoring and dark web monitoring, and Meta is notifying regulators. Recipients of a notice should enroll in the monitoring offered. Meta has not told the wider public to take any action.

The breach adds to a run of intrusions in 2026 that started with a single developer’s access. In May, GitHub itself confirmed that about 3,800 of its internal repositories were stolen after an employee installed a poisoned Visual Studio Code extension. Nothing Meta has disclosed links that are related to this one.

Several questions remain open. Meta has not said which products’ code was taken, which regulators it has notified, or who the non-employees among the 1,500 affected people are. It also has not said whether any of the rotated secrets were used before they were replaced.