Meta says hackers accessed its GitHub, exposing personal data of 1,500 people
Follow UsMeta has informed around 1,500 people that their personal information may have been exposed after hackers gained access to the company’s GitHub repositories.
Meta discovered the incident a few weeks ago and found that an outside group had used an employee’s stolen login credentials to enter the repositories.
Meta said most of the stolen information was business data, while a small portion contained personal details.
Meta has informed around 1,500 people that their personal information may have been exposed after hackers gained access to some of the company’s GitHub repositories. Most of the affected people are employees based in the US. Meta discovered the incident a few weeks ago and found that an outside group had used an employee’s stolen login credentials to enter the repositories. The company blocked the attackers and contacted GitHub and law enforcement agencies. Notifications to affected individuals began on Tuesday. Meta said most of the stolen information was business data, while a small portion contained personal details.
SurveyMeta told SecurityWeek that around 99 per cent of the information accessed by the hackers was business data. This included software code linked to some of its products. The remaining 1 per cent was personal information that had been stored in the repositories by mistake.
Also read: OpenAI finds hidden recording device in office, says AI helped identify employee behind it
The company said this information should not have been uploaded to GitHub, as doing so violated its internal policies. However, Meta has not revealed what types of personal information were involved in the incident.
The company also said that much of the data that appeared to contain personal information was actually synthetic or anonymised test data. This means the hackers may find it difficult to distinguish real records from test information.
Meta said its investigation, conducted with GitHub, has not found any evidence that the attackers specifically targeted the company’s data. The company is offering credit and dark web monitoring services to people whose information was involved.
Also read: OpenAI reportedly wants to bring back Sora AI, but not everyone may be able to use it
“This was not a vulnerability in any Meta product, and Meta’s internal systems were not breached. Meta business data held in a GitHub repository was improperly accessed using an employee’s stolen credentials – this included a small amount of personal data for a limited number of people, most of whom were Meta employees,’ a Meta spokesperson told SecurityWeek.
Following the incident, Meta rotated secrets found in the affected repositories. It has also introduced additional security measures to reduce the risks.
The company is working with teams that use GitHub to ensure personal information is not stored on the platform. Meta is also introducing automated checks to identify user data that may have been uploaded by mistake.
Also read: Anthropic warns AI models may soon self-replicate without access to a datacentre: Check details
