SAN FRANCISCO — Hackers used an employee’s stolen credentials to gain access to some of Meta’s GitHub repositories and obtained product source code along with personal data on about 1,500 people, most of them Meta employees in the United States, the company confirmed Tuesday.
Meta notified SecurityWeek of the intrusion on Oct. 13, 2026, the same day it began contacting those affected. The company said an outside group entered the repositories using the credentials of a single employee. Meta has not said how the credentials were stolen.
The intrusion was detected a few weeks ago. Meta’s security team cut off the attackers’ access and notified GitHub and law enforcement. Based on its investigation with GitHub so far, Meta said it does not believe the attackers specifically targeted the company.
A Meta spokesperson told SecurityWeek that “Meta’s internal systems were not breached.” The company described the incident as improper access to business data held on GitHub rather than a flaw in any Meta product.
According to Meta, 99% of the data the attackers took was business data in the form of software code for some of its products. The remaining 1% was personal data. That personal information should never have been present in the repositories, Meta said. It was added by mistake, and storing it on GitHub violated company policy.
Meta also said a significant share of what appeared to be personal data was synthetic or anonymized test data. The company argued this could make it harder for the attackers to distinguish real records from fake ones.
Meta has not disclosed which types of personal data were exposed, how many repositories were accessed or which products the stolen code belongs to. It has not identified the attackers or specified when the intrusion began, as distinct from when it was detected.
In response, Meta rotated secrets it found in the affected repositories, indicating that credentials or keys had been stored alongside the code the attackers took. The company said it has hardened product security against risks that could follow from the exposure of its business data. It is also working with its GitHub teams to keep user data off the platform and is adding proactive scanning to catch any that slips through.
Meta is notifying regulators. The people affected are being offered credit monitoring and dark web monitoring.
GitHub is a widely used platform for storing and managing software code. Companies often keep proprietary source code and related materials there, making unauthorized access a concern for both intellectual property and any sensitive information that may be included. Meta said the bulk of what was taken consisted of business data rather than consumer information, though the presence of any personal data in the repositories marked a departure from its own policies.
The company has not released further details about the scope of the repositories involved or the specific products whose code was obtained. Officials continue to investigate the incident with GitHub’s assistance and in coordination with law enforcement.
