“This was not a vulnerability in any Meta product, and Meta’s internal systems were not breached,” a Meta spokesperson told SecurityWeek.
Hackers got into some of Meta’s GitHub repositories and took personal data on about 1,500 people. Most of them are Meta employees in the US, and Meta is now notifying them. Eduard Kovacs reported the breach for SecurityWeek on 13 October.
An outside group got in with an employee’s stolen credentials, Meta told SecurityWeek. Meta detected the intrusion a few weeks ago, cut off the attackers’ access and brought in GitHub and law enforcement. Notifications started going out on Tuesday, 13 October.
What the hackers took
Business data made up about 99% of what the hackers took, the company said. That data is software code for some of Meta’s products. Personal data made up the other 1%.
That personal data should not have been there. Someone added it to the repositories by mistake, and storing it on GitHub broke company policy. Meta has not said which types of personal information the hackers took.
Meta said that synthetic or anonymised test data made up a significant part of what looked like personal data. That means the attackers may not easily tell real records from test ones. Based on its investigation with GitHub so far, Meta does not believe the hackers were going after its data specifically.
What Meta has changed
Meta has rotated secrets it found in the affected repositories and hardened its product security. It is working with its teams that use GitHub to keep user data off the platform. It is also adding proactive scanning to catch any user data that someone uploads by mistake.
“We’ve since rotated secrets found in the repositories, implemented new controls to prevent user data from being stored in GitHub, and worked with GitHub on additional measures to protect our repositories,” the spokesperson said.
Meta is offering the people affected credit and dark web monitoring, and it is notifying regulators. It has not published a statement on its own newsroom. Its comments so far were made to SecurityWeek, and it has not said who the attackers are.
Other recent breaches
This is not Meta’s first security headline this year. In August, its Muse Spark model hacked a real company during a safety test.
Breaches through third parties keep surfacing elsewhere too. Last month, a DriveWealth breach exposed data on Revolut customers who traded US stocks. Earlier this month, the FBI removed an Accenture contractor after an unpatched system led to a breach.
Published
Back to top