Meta to notify 1,500 users after stolen employee credentials expose GitHub repositories

Meta is contacting around 1,500 people after an unauthorised party accessed company repositories on GitHub, exposing software development material and a smaller quantity of personal information that should never have been stored there.

Most of those receiving notifications are based in the United States, and the majority are Meta employees. The company began informing affected individuals on Tuesday, following an investigation into an intrusion discovered several weeks earlier.

The incident highlights a security risk that can arise when developers store sensitive information alongside source code on external platforms. Although Meta has stressed that neither a vulnerability in its products nor a breach of its internal systems was involved, the stolen material included business data that required remedial action.

Stolen credentials opened the door to company repositories

According to Meta, an external group obtained access through an employee’s compromised login credentials. The company subsequently blocked the intruders and sought assistance from GitHub and law enforcement authorities.

Meta told SecurityWeek that approximately 99 per cent of the material taken consisted of business information, including software code associated with some of its products. The remaining portion comprised personal data, which the company has not publicly described in detail.

The personal information was present in the repositories because it had been uploaded inadvertently, in breach of Meta’s internal rules. The company has not identified the categories of information involved, leaving it unclear whether the exposed records included contact details, financial information or other sensitive data.

There is, however, an additional complication in assessing the potential impact. Meta said a substantial share of the material that appeared to contain personal information was actually synthetic or anonymised data used for testing. That could make it harder for anyone examining the stolen files to distinguish real individuals’ records from test material, although it does not establish that genuine information was inaccessible or unused.

The company has not disclosed the identity of the attackers or provided evidence that they deliberately targeted Meta. Its investigation, conducted with GitHub, has so far given it no reason to believe the group specifically sought out the company’s information.

A Meta spokesperson told SecurityWeek, “This was not a vulnerability in any Meta product, and Meta’s internal systems were not breached.”

That distinction narrows the reported route of entry but does not remove the risks associated with the exposed repositories. Source code can contain information about how products operate, while credentials accidentally embedded in development files may provide access to other systems if they remain valid.

Meta changes credentials and introduces additional safeguards

In response, Meta has replaced the secrets identified in the affected repositories. These can include API keys, authentication tokens and passwords used by software and services to communicate securely. Replacing them is intended to invalidate exposed credentials, although Meta has not said whether any were exploited before the changes took effect.

The company has also strengthened security measures designed to reduce the risks associated with outsiders obtaining its business data. It is working with internal teams that use GitHub to prevent personal information from being uploaded to repositories in the first place.

Further controls are being introduced to scan material proactively and flag user data that appears in the wrong location. Meta has also worked with GitHub on additional protections for its repositories. The effectiveness of these measures has not been independently established.

For those affected, the immediate response includes offers of credit monitoring and dark web monitoring services. Meta is also notifying the relevant regulators, though it has not named the authorities involved. People who receive a notification can use the monitoring services offered to them.

Several details remain undisclosed, including which products were represented in the stolen code, how many affected individuals were not employees and whether investigators found evidence that the personal information had been used. Meta has not called on the wider public to take specific action.

The incident also comes amid broader concerns about the security of software development environments. In May 2026, GitHub confirmed that about 3,800 of its internal repositories had been stolen after an employee installed a malicious Visual Studio Code extension. No evidence disclosed by Meta links the two incidents.