Meta admits: Unusual breach exposed personal information of thousands of users

Meta announced a breach of its internal code repositories on GitHub, using stolen employee login credentials. Approximately 1,500 people, mostly employees in the US, received warning notifications. The stolen data was primarily software code, but a small percentage included personal information, uploaded due to human error in violation of policies. The company cut off access, replaced encryption keys, and strengthened security measures.

Meta has admitted to an unusual breach of its internal code repositories on the GitHub platform. According to a report in SecurityWeek, external attackers used stolen employee login credentials to penetrate an isolated repository. The company began sending warning notifications to approximately 1,500 people, most of them employees in the United States. The vast majority of the stolen data (about 99%) is software code related to the company's products. A small percentage included personally identifiable information, but Meta emphasizes that much of it was synthetic or anonymized test data. An embarrassing detail in the internal investigation: the personal information was uploaded to the repository due to human error, in direct violation of security policies prohibiting the storage of user data on external platforms. The company cut off the attackers' access, replaced encryption keys, and hardened its defense mechanisms. It involved law enforcement authorities and reported to regulators. Affected employees and users are being offered credit monitoring services and alerts against data trading on the dark web.