2026 Meta — GitHub repos accessed via stolen employee login; ~1,500 people’s data
Data compromised
Meta via SecurityWeek: ~99% of taken data was business/source code for some products; ~1% personal data stored in repos contrary to policy (types not specified). ~1,500 people notified, mostly US-based Meta employees; credit and dark-web monitoring offered. Significant share of apparent PII described as synthetic/anonymized test data. Secrets in affected repos rotated. No indication Meta’s consumer-user base was in the take.
Technical writeup
Verified Meta statements to SecurityWeek (13 Oct 2026; notifications began that Tuesday). Stolen employee GitHub credentials; access cut; GitHub and law enforcement engaged; regulators notified. Company: not a product vuln; internal systems not breached; most of the take was product source code; personal data should not have been in GitHub. Remediation: rotate secrets, harden product security against leaked business data, scanning/controls to keep user data off GitHub. recordsAffected 1500; companyConfirmed true.
Root cause
Outside group used a Meta employee’s stolen credentials to access some company GitHub repositories (detected a few weeks before 13 Oct 2026 disclosure). Not a Meta product vulnerability; internal Meta systems not breached, per company.