Meta says hackers used an employee’s stolen login details to get into some of its code repositories on GitHub, and it is now notifying roughly 1,500 people whose personal information was caught up in the breach. Most of them are Meta employees in the US, the company told SecurityWeek on 13 October 2026 [1].
What happened
According to Meta’s account to SecurityWeek, the intrusion was detected a few weeks ago. An outside group got in using an employee’s stolen credentials, meaning a valid username and password or similar login details, rather than by breaking through a security flaw [1].
Meta said its security team shut down the attackers’ access and brought in GitHub and law enforcement. Notifications to the affected people started going out on Tuesday, 13 October [1].
What code repositories and “secrets” are
A code repository is a shared online folder where software teams store their source code, the human-written instructions that make an app or service work, along with its full history of changes. GitHub, owned by Microsoft, is the most widely used service for hosting them.
“Secrets” are the passwords, digital keys and access tokens that programs use to log in to other systems, such as databases or cloud services. They sometimes end up inside code by accident. If an attacker copies them, they may be able to get into those other systems, so the standard fix is to “rotate” them: cancel the old ones and issue new ones.
What was taken
Meta told SecurityWeek that 99% of the data the hackers took was business data, mainly software code linked to some of its products. The remaining 1% was personal data [1].
According to Meta, that personal data had been put in the repositories by mistake and should not have been there, because storing it on GitHub was against company policy. Meta has not said what types of personal information were involved. It added that much of what looked like personal data was actually synthetic or anonymised test data, so the attackers may not easily be able to tell real records from fake ones [1].
Based on its investigation with GitHub so far, Meta said it does not believe the hackers were specifically after its data [1].
What Meta said
“This was not a vulnerability in any Meta product, and Meta’s internal systems were not breached. Meta business data held in a GitHub repository was improperly accessed using an employee’s stolen credentials – this included a small amount of personal data for a limited number of people, most of whom were Meta employees,” a Meta spokesperson told SecurityWeek [1].
“We’ve since rotated secrets found in the repositories, implemented new controls to prevent user data from being stored in GitHub, and worked with GitHub on additional measures to protect our repositories,” the spokesperson said [1].
What Meta is doing now
Meta said it is notifying regulators and offering the affected people credit and dark-web monitoring, services that watch for signs their details are being misused or sold online [1]. According to SecurityWeek, Meta has also strengthened product security, is working with its teams to keep user data off GitHub, and is adding automatic scanning to catch personal data uploaded by mistake [1].
What this means
- It started with a login, not a bug. By Meta’s account, the attackers did not exploit a flaw; they used an employee’s stolen credentials. That is one of the most common ways breaches begin.
- Most affected people are staff. Meta says the roughly 1,500 people being notified are mostly its own US employees.
- Key details are still missing. Meta has not said what personal data was involved, which products the code relates to, or who the attackers were.
Sources
- SecurityWeek (Eduard Kovacs), “Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach”, 13 October 2026. https://www.securityweek.com/meta-says-hackers-took-code-personal-data-of-1500-in-github-breach/
Related stories
- GitLab Patches CVE-2026-97229, a CVSS 10.0 Flaw That Could Let an Unauthenticated User Run Code Through a Crafted CI/CD Regex
- SAP Fixes Maximum-Severity OAuth2 Flaw in Its Cloud SDK for Python in October 2026 Patch Day
- Meta, 14 Other Tech Companies and Law Enforcement Disrupt Scam Networks in West Africa
- Attackers Are Exploiting an Ivanti Connect Secure Zero-Day, and CISA Gives US Agencies Until 16 October to Act
- Docker Hub Flaw Handed Users’ Access Tokens to New Owners When Accounts Became Organisations; Docker Says It Is Fixed
