Meta is delivering notifications to roughly 1,500 people, most of them US-based employees, saying intruders compromised their personal information after entering some of the company’s GitHub repositories; the alerts started on Tuesday. Meta detected the intrusion a few weeks ago after an outside group gained access using an employee’s stolen credentials. The company’s security team blocked the intruders’ entry and enlisted GitHub and law enforcement to assist.
According to Meta, attackers stole business code—about 99 percent of the taken data—with roughly 1 percent consisting of personal information. The personal information ended up in the repositories by accident and Meta should not have stored it there, since placing user data on GitHub violates company policy. Meta has not disclosed which specific categories of personal data it affected. Meta added that much of the information resembling personal data was in fact synthetic or anonymized test material, making it difficult for the attackers to distinguish real records from the placeholder data.
Thus far in its review with GitHub, Meta says it does not think the intruders were targeting its data specifically. Also, Meta is informing regulators and providing affected individuals with credit monitoring and dark web surveillance.
Meta stated, “Meta business data held in a GitHub repository was improperly accessed using an employee’s stolen credentials,” and rotated the secrets discovered in those repositories. The firm also strengthened its product defenses to mitigate risks arising from exposure of its business code.
Meta is collaborating with its GitHub-using teams to ensure no user information remains on the service. As a safeguard, Meta is implementing proactive scanning tools designed to catch any user information inadvertently uploaded.
Join the discussion