Threat reportData BreachTL-2026-3486
Meta GitHub Repositories Breached via Stolen Employee Credentials; Source Code and Personal Data of ~1,500 People Stolen
Meta GitHub Repositories Breached via Stolen Employee (TL-2026-3486) is a medium-severity data breach, first published 2026-10-14. It has no confirmed attribution, affects Meta Meta GitHub-hosted source code repositories (specific, maps to 3 MITRE ATT&CK techniques (T1078, T1213.003, T1552.001), and is covered by 9 detection rules and 8 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3486
- Threat ID
- TL-2026-3486
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, social-media
- Target regions
- North America
- Detection rules
- 9
- Indicators of compromise
- 8
How Meta GitHub Repositories Breached via Stolen Employee works
Attackers used stolen employee credentials to access Meta's GitHub repositories and took product source code (about 99% of the stolen data) plus a small amount of personal information (about 1%) affecting roughly 1,500 people, mostly U.S.-based Meta employees. Meta detected the intrusion several weeks before it began notifying affected individuals on 2026-10-13; the attackers have not been identified.
Meta disclosed on 2026-10-13 (first reported by SecurityWeek) that unidentified attackers accessed some of its GitHub repositories using stolen employee credentials. Meta's security team detected the intrusion a few weeks before the disclosure (the exact date and intrusion start were not published), cut off the attackers' access, and engaged GitHub and law enforcement. Per Meta, the incident was not caused by a vulnerability in any Meta product and Meta's internal systems were not breached; only the GitHub repositories were affected. One syndicated account (International Cyber Digest) states the credentials belonged to a single employee; Meta has not said how the credentials were stolen or whether multi-factor authentication was in place.
About 99% of the stolen material was business data, i.e. software source code related to Meta products, and about 1% was personal information concerning approximately 1,500 individuals, mostly U.S.-based Meta employees. Meta stated that it mistakenly placed personal information in the repositories despite company rules prohibiting storing it on GitHub, and that a significant portion of the apparent personal records was synthetic or anonymized test data. The specific personal data types, the number of repositories accessed, and which products' code was taken were not disclosed.
Meta's investigation with GitHub found no indication that the attackers were targeting Meta specifically, and there is no reported evidence that the stolen code was modified, published, or weaponized. No attribution, malware, CVE, or network indicators of compromise have been published. Meta's response included blocking attacker access, rotating secrets exposed in the repositories, strengthening product security, implementing controls to prevent user data being stored in GitHub, deploying proactive scans for accidentally uploaded user information, coordinating with GitHub on additional protections, notifying regulators (unnamed), and offering affected individuals credit monitoring and dark web monitoring.
Defensive relevance: this is a credential-based initial access (T1078) followed by collection from a code repository (T1213.003). Because Meta rotated secrets found in the repositories, secrets stored in code (T1552.001) are a downstream exposure risk, although use of those secrets by the attacker was not reported. Lessons are the hygiene of source-control accounts (phishing-resistant MFA, session/token controls, anomaly detection on bulk clone/download activity), keeping secrets and personal data out of repositories, and secret scanning. Coverage rests on SecurityWeek and derivative reports; Meta's own notification text was not available to this analysis, and BeaconBeagle correlation was not applicable because no network IOCs were disclosed.
MITRE ATT&CK techniques used in TL-2026-3486
Initial Access
Persistence
Privilege Escalation
Defense Evasion
Collection
Credential Access
Affected products and versions in Meta GitHub Repositories Breached via Stolen Employee
- Meta — Meta GitHub-hosted source code repositories (specific repositories and products not disclosed)
Remediation for Meta GitHub Repositories Breached via Stolen Employee
Immediate actions
- Rotate all secrets, tokens and API keys stored in or ever committed to source repositories
- Revoke and reissue developer credentials, personal access tokens and SSH keys for affected accounts
- Review GitHub audit logs for anomalous logins, new tokens/keys and bulk clone or archive-download activity
- Run secret scanning and PII scanning across all repositories and their history
Workarounds
- Restrict repository access by IP allow-list or conditional access where feasible
- Offer credit and dark web monitoring to affected individuals (as Meta did)
Longer-term hardening
- Enforce phishing-resistant MFA (FIDO2/passkeys) and SSO with short-lived sessions for all source-control accounts
- Prohibit personal data in repositories and enforce with pre-commit and push-protection scanning
- Alert on unusual repository access volume, new geographies/ASNs and off-hours cloning
- Use synthetic test data that is verifiably non-personal
Weaknesses (CWE) in Meta GitHub Repositories Breached via Stolen Employee
Timeline of Meta GitHub Repositories Breached via Stolen Employee
- Approximate window: Meta's security team detects the intrusion 'a few weeks' before the 2026-10-13 disclosure and cuts off attacker access (exact detection and intrusion-start dates undisclosed).
- Meta's investigation with GitHub finds no indication the attackers targeted Meta specifically; Meta states this was not a vulnerability in any Meta product and internal systems were not breached; no evidence of code modification, publication or weaponization was reported.
- Meta reports it blocked attacker access, rotated exposed secrets, strengthened product security, added controls and proactive scans for user data uploaded to GitHub, is working with GitHub on added protections, and is notifying regulators; GitHub and law enforcement were engaged.
- Meta states about 99% of the stolen data was product source code and about 1% personal information that was mistakenly placed in the repositories against policy; a significant portion was synthetic or anonymized test data.
- Meta begins notifying approximately 1,500 affected individuals, mostly U.S.-based Meta employees, and offers credit monitoring and dark web monitoring.
- Meta confirms to SecurityWeek that attackers used stolen employee credentials to access some of its GitHub repositories.
- Cyber Security News and Cyber Kendra publish follow-up coverage; no attribution, IOCs or details on how the credentials were stolen or whether MFA was enabled are provided.
Sources cited for Meta GitHub Repositories Breached via Stolen Employee
- Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach (SecurityWeek)
- Hackers Breach Meta GitHub Repositories, Steal Source Code and Data of 1,500 People (Cyber Security News)
- Meta GitHub Breach: Hackers Steal Code, Data of 1,500 (Cyber Kendra)
- Hackers stole Meta source code and staff data from its GitHub repos (International Cyber Digest)
- Meta Says Hackers Stole Code and Personal Data of 1,500 Mostly US Employees via Compromised GitHub Repos (AI Weekly)
- Meta GitHub breach exposes data of 1,500 people (Cybernews)
- Meta says hackers accessed GitHub repositories using stolen employee credentials (NewsBytes)
- Meta GitHub Breach Exposes Code and Data of 1,500 (Tech Journal)
Detection coverage for TL-2026-3486
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3486 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.