Meta notifies about 1,500 people, mostly US employees, after an outside group used an employee's stolen credentials to copy code and some misplaced personal data from Meta GitHub repositories
Meta told SecurityWeek on 13 October 2026 that it is notifying roughly 1,500 people, most of them employees in the United States, that their personal information was affected after attackers got into some of the company's GitHub repositories. The intrusion was detected a few weeks earlier: an outside group used an employee's stolen credentials. Meta says about 99% of what was taken was business data, mainly software code for some of its products, and 1% was personal data that had been put in the repositories by mistake against company policy; much of what looked like personal data was synthetic or anonymised test data. Meta has not said which types of personal information were involved. It says this was not a vulnerability in any Meta product and its internal systems were not breached. Meta cut off the access, brought in GitHub and law enforcement, rotated secrets found in the repositories, added controls to keep user data out of GitHub with proactive scanning, and is notifying regulators; affected people are offered credit and dark-web monitoring. Notifications began on Tuesday 13 October (US time). No Australian impact has been stated. Source: SecurityWeek, quoting a Meta spokesperson; no public Meta notice yet.
- Product
- Meta corporate GitHub repositories (source code and misplaced personal/test data)
- Versions
- n/a — incident (stolen employee credentials, not a product vulnerability)
- Exploited in Australia?
- unknown
- Patch to
- Nothing to patch. Lessons for any GitHub organisation: require phishing-resistant MFA and SSO for all members, scan repositories for secrets and personal data and rotate anything found, review personal access tokens and OAuth apps, and alert on unusual clone or download volumes.