-
A hacker used a stolen Meta employee login to enter some of the company’s GitHub code folders.
-
Meta says 99% of the stolen data was business information, and the other 1% was personal data.
-
The company is alerting about 1,500 people and offering credit and dark web monitoring services.
Meta is alerting about 1,500 people after an outside group entered some of its GitHub code folders. The group used a stolen Meta employee login to get in. A login is the username and password that open an account. A report published on October 13, 2026 shared the news.
Most affected people are Meta employees based in the United States. GitHub is a website where developers store and share software code. Those storage spaces are called repositories, and this story calls them code folders.
Meta noticed the intrusion a few weeks before it sent the alerts. Its security team then blocked the unauthorized access, which means entry without permission. The company also brought in GitHub and law enforcement to investigate the case. Meta began alerting the affected people on Tuesday, October 13.
Stolen Employee Login Opened the Door to GitHub
The attack exposed software code linked to some Meta products. Source code is the set of written instructions that makes a program run. A smaller amount of personal information was also exposed. However, Meta says the attack did not use a flaw in any of its products. The company also says hackers did not break into its internal systems.
According to a Meta spokesperson, the incident involved unauthorized access to business data stored in a GitHub folder. The spokesperson stressed that no weakness in a Meta product caused it. The spokesperson also said the company’s internal systems were not breached.
This detail matters because the entry point was a hacked employee login, not a known software flaw. A software flaw is a weak spot in a program that hackers can use. Even so, the case shows a clear risk. When someone takes over a developer’s account, they can access sensitive information stored in code folders. Meta has not named the group behind the attack. It has also not explained how the employee’s login details were stolen.
Nearly All the Stolen Data was Software Code
Meta told reporters that about 99% of the stolen data was business information. Most of it was source code for some of its products. The other 1% was personal data. Someone added it to the folders by mistake, which goes against company policy.
Meta has not shared which types of personal information were involved. However, the company said a large part of the data that looked personal was actually fake or anonymized test data. Developers use test data to try out software. Anonymized data has names and other identifying details removed. This could make it hard for attackers to tell real records from test records.
Meta also said its investigation with GitHub found no sign that the attackers aimed at its data on purpose. Reports say the company has not named the group responsible.
Meta Changes Passwords and Adds New Safeguards
After the discovery, Meta changed the secrets found in the affected folders. Secrets are items like access keys, passwords, and other login details. Apps use them to talk to outside services. A secret works a bit like a key to a locked door. Changing them lowers the chance that attackers can reuse them to reach connected systems.
Meta is also working with teams that use GitHub to keep personal information off the platform. It is adding new controls and active scanning. Scanning means a tool checks files on its own for items that should not be there. These tools will look for user data that someone uploaded to the folders by accident.
The company is also telling the right regulators about the incident. Regulators are the official groups that check whether companies follow the rules. It is offering credit monitoring and dark web monitoring services to the affected people.
Credit monitoring tracks changes to a person’s credit file. Dark web monitoring checks hidden parts of the internet for leaked personal data. These steps cover two different risks. One is the misuse of personal information. The other is the chance that exposed login details could open other resources.
Several details are still unclear. Meta has not shared the full list of folders involved. It has not said whether the stolen data was later used in more attacks. Its public statement also does not say whether the attackers reached any connected services beyond the affected folders.
The case highlights the value of limiting folder permissions. It also shows why strong sign-in protection for employee accounts matters. Strong protection adds an extra check on top of a password. Scanning code folders for exposed passwords and personal data helps too.
Beyond cybersecurity, Meta also faces legal scrutiny over the impact of its platforms on young users. The company is facing a major trial over claims that Facebook and Instagram harm children, as reported in Meta faces major trial over claims Facebook and Instagram hook kids.
For now, Meta says it has ended the unauthorized access. It also says it changed the exposed secrets and added new safeguards. Whether those steps work, and whether the stolen data has been misused, depends on further investigation.
