Personal data stolen from Meta’s GitHub: Why was it even there?
The Facebook and Instagram owner says it uploaded personal data to GitHub by mistake.
Human figurines placed in from of the Meta logo. CFOTO/Future Publishing via Getty Images.
Follow us
- Hackers used a stolen employee credential to access Meta GitHub repositories and take code and business data.
- Meta says about 1,500 people are affected, mostly US employees, and personal data was 1% of the theft.
- Meta says its products and internal systems were not breached, and it has cut off the attackers’ access.
- Meta is offering monitoring services and adding controls to detect personal information uploaded to GitHub by mistake.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
American tech giant Meta is notifying over a thousand people after hackers accessed its GitHub repositories using a stolen employee account.
Hackers broke into Meta’s GitHub repositories using a stolen employee credential, taking software code and personal information affecting approximately 1,500 people.
Meta said the attackers took mainly business data, including software code associated with some of the company’s products. Personal information accounted for just 1% of the stolen data, according to the company’s statement.
Most of the affected individuals are Meta employees in the US. However, Meta has not disclosed exactly what types of information were involved.
Hackers may have taken personal data by mistake
According to Meta, personal information ended up in the affected repositories accidentally, despite company policies prohibiting its storage on GitHub.
The company said a significant portion of what appeared to be personal information was actually synthetic or anonymized test data. This could make it harder for attackers to distinguish genuine records from data used for testing.
The company said it is offering affected individuals credit monitoring and dark web monitoring services as it continues investigating the incident.
Meta says its internal systems are not affected
The breach was detected a few weeks ago, while the notifications only started going out this Tuesday. Meta says it has since cut off the attackers’ access and enlisted GitHub and law enforcement.
“This was not a vulnerability in any Meta product, and Meta’s internal systems were not breached,” a Meta spokesperson told SecurityWeek.
“Meta business data held in a GitHub repository was improperly accessed using an employee’s stolen credentials – this included a small amount of personal data for a limited number of people, most of whom were Meta employees.”
The company also said its investigation, conducted with GitHub, has not uncovered evidence that the attackers specifically targeted Meta’s data.
Check if your data was exposed
Find out if your email and related personal information have appeared in known data breaches.
Meta said it has rotated secrets discovered in the affected repositories as part of its response.
The company is also introducing additional measures to prevent similar incidents, including controls designed to detect personal information uploaded to GitHub by mistake.
Cybernews previously reported on a massive data scrape from one of Meta’s platforms, Facebook.
The perpetrators alleged they had a database with 1.2 billion user records. According to a post on a data leak forum, the database was made by abusing one of the social media platform‘s application programming interfaces (APIs).
In July this year, a bug in Meta’s Instagram account recovery tool helped hackers take control over more than 20,000 accounts.
