Hackers used an employee’s stolen credentials to access some of Meta’s GitHub repositories, taking product source code and personal information linked to roughly 1,500 people. Most affected individuals are Meta employees in the United States, according to the company’s disclosure to SecurityWeek.

Meta confirmed the breach on October 13, 2026, when it began notifying affected people. The company said it detected the intrusion several weeks earlier, blocked the attackers’ access, and brought in GitHub and law enforcement to support its response.

Stolen Credentials Opened Repository Access

Meta said attackers entered through stolen employee credentials, not a flaw in a Meta product. The company also said its internal systems were not breached. The disclosed incident involved business data held in GitHub repositories.

The report does not explain how the credentials were stolen or identify the attackers. Meta said its investigation with GitHub had not indicated that the group specifically targeted Meta’s data. That assessment remains based on the investigation so far.

According to Meta, 99% of the stolen material was business data, consisting of software code related to some products. Personal information accounted for the remaining 1%. Those percentages describe the stolen material, not the share of employees affected.

Meta has not named the affected products or detailed the repository contents. The disclosure does not say that attackers changed code, published it, or used it to compromise other systems.

Meta told SecurityWeek it mistakenly placed personal information in the repositories, despite company rules that prohibit storing it on GitHub. The company has not disclosed which types of personal information were taken, leaving the full privacy impact unclear.

A significant portion of material that appeared to contain personal information was synthetic or anonymized test data, Meta said. The company believes this could make it harder for attackers to separate genuine records from test records. However, that does not remove the need to protect people whose real information was exposed.

Meta is notifying regulators and offering affected individuals credit monitoring and dark web monitoring services. These measures form part of its response while it addresses the repository exposure and its handling of personal data.[securityweek]

Meta Rotates Secrets and Adds Data Checks

Meta said it rotated secrets found in the affected repositories and strengthened product security to address risks from the stolen business data. It is also introducing proactive scans to detect user information uploaded by mistake and working with GitHub on additional repository protections.

GitHub’s guidance on leaked secrets explains why replacing exposed credentials matters. Removing a secret from source code alone is not enough. Teams must revoke it through its provider and generate a replacement where needed to prevent further use.

The incident follows other repository thefts covered by CybersecurityNews, including CrowdSec’s loss of about 170 private GitHub repositories through a compromised former employee account. Separate reporting on hundreds of thousands of active credentials exposed on GitHub highlights the need to revoke leaked keys promptly.

Neither report establishes a connection to Meta’s breach. Together, they show why repository security must cover both account access and the data stored inside code projects.

The post Hackers Breach Meta GitHub Repositories, Steal Source Code and Data of 1,500 People appeared first on Cyber Security News.