Meta confirmed that there was a theft of code and personal data affecting approximately 1,500 individuals, most of whom are employees located in the United States. The attackers managed to access the company's repositories on the GitHub platform using credentials obtained from an employee.
The company assured that no intrusion occurred into its internal systems, nor were security vulnerabilities exploited in its products. According to SecurityWeek, the notifications were sent to those affected this Tuesday, the 13th.
Meta reported that 99% of the extracted material consisted of corporate code, while only 1% was personal data inadvertently stored in the repositories, which contradicted the company's internal guidelines. Although it was not specified what types of private information were exposed, the company took immediate measures.
To contain the situation, the company blocked the attackers' access, notified the competent authorities, and proceeded to renew the credentials found in the repositories. Additionally, scans were conducted to locate improperly stored data, and support was offered to the affected employees.
GitHub functions as a platform for code hosting and management, where projects are structured in repositories that can be public or private. These environments maintain a historical record of file modifications, facilitating version tracking and collaboration in software development.
GitHub's official security documentation warns that credentials can spread through copies of repositories and even backup systems, which complicates the complete elimination of exposed information. For this reason, simply deleting a file from the latest version does not resolve the exposure, as the content may remain accessible. If a credential is compromised, it is essential to change it to prevent new access. The platform provides resources for detecting credentials in repositories, but effective protection may require additional configurations.
Previous cases illustrate similar risks: in 2022, Dropbox confirmed the theft of 130 private repositories on GitHub following a phishing attack. The attackers simulated messages from CircleCI, a tool used by Dropbox developers, leading an employee to provide their credentials on a fraudulent page. The stolen material included prototypes and internal tools, although Dropbox stated that user files and passwords were not compromised.
Additionally, in 2023, excerpts of Twitter's code were published on GitHub, leading the social network to request the removal of the material due to copyright infringement and begin searching for the responsible party.