Meta is notifying roughly 1,500 people, most of them employees in the US, that their personal information was impacted after hackers got into some of the company’s GitHub repositories.
The intrusion was detected a few weeks ago. According to the tech giant, an outside group gained access to the repositories using an employee’s stolen credentials.
Meta’s security team shut down the attackers’ access and brought in GitHub and law enforcement. Notifications to the impacted individuals started going out on Tuesday.
Meta told SecurityWeek that 99% of the data the hackers took was business data, in the form of software code related to some of its products. The remaining 1% was personal data.
That personal data had been added to the repositories by mistake and should not have been there, as storing it on GitHub went against company policy. Meta has not said what types of personal information were involved.
The company also noted that a significant portion of what looked like personal data was actually synthetic or anonymized test data. As a result, the attackers may not readily be able to tell genuine records apart from test data.
Based on its investigation with GitHub so far, Meta does not believe the hackers were specifically after its data.