# Meta GitHub Repositories Breached via Stolen Employee Credentials; Source Code and Personal Data of ~1,500 People Stolen

> Attackers used stolen employee credentials to access Meta's GitHub repositories and took product source code (about 99% of the stolen data) plus a small amount of personal information (about 1%) affecting roughly 1,500 people, mostly U.S.-based Meta employees. Meta detected the intrusion several weeks before it began notifying affected individuals on 2026-10-13; the attackers have not been identified.

- **Published:** 2026-10-14T09:00:37Z
- **Last reviewed:** 2026-10-14T09:00:37Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3486
- **ID:** TL-2026-3486
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Meta disclosed on 2026-10-13 (first reported by SecurityWeek) that unidentified attackers accessed some of its GitHub repositories using stolen employee credentials. Meta's security team detected the intrusion a few weeks before the disclosure (the exact date and intrusion start were not published), cut off the attackers' access, and engaged GitHub and law enforcement. Per Meta, the incident was not caused by a vulnerability in any Meta product and Meta's internal systems were not breached; only the GitHub repositories were affected. One syndicated account (International Cyber Digest) states the credentials belonged to a single employee; Meta has not said how the credentials were stolen or whether multi-factor authentication was in place.

About 99% of the stolen material was business data, i.e. software source code related to Meta products, and about 1% was personal information concerning approximately 1,500 individuals, mostly U.S.-based Meta employees. Meta stated that it mistakenly placed personal information in the repositories despite company rules prohibiting storing it on GitHub, and that a significant portion of the apparent personal records was synthetic or anonymized test data. The specific personal data types, the number of repositories accessed, and which products' code was taken were not disclosed.

Meta's investigation with GitHub found no indication that the attackers were targeting Meta specifically, and there is no reported evidence that the stolen code was modified, published, or weaponized. No attribution, malware, CVE, or network indicators of compromise have been published. Meta's response included blocking attacker access, rotating secrets exposed in the repositories, strengthening product security, implementing controls to prevent user data being stored in GitHub, deploying proactive scans for accidentally uploaded user information, coordinating with GitHub on additional protections, notifying regulators (unnamed), and offering affected individuals credit monitoring and dark web monitoring.

Defensive relevance: this is a credential-based initial access (T1078) followed by collection from a code repository (T1213.003). Because Meta rotated secrets found in the repositories, secrets stored in code (T1552.001) are a downstream exposure risk, although use of those secrets by the attacker was not reported. Lessons are the hygiene of source-control accounts (phishing-resistant MFA, session/token controls, anomaly detection on bulk clone/download activity), keeping secrets and personal data out of repositories, and secret scanning. Coverage rests on SecurityWeek and derivative reports; Meta's own notification text was not available to this analysis, and BeaconBeagle correlation was not applicable because no network IOCs were disclosed.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1213.003 Code Repositories
- T1552.001 Credentials In Files

## Sources

- [Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach (SecurityWeek)](https://www.securityweek.com/meta-says-hackers-took-code-personal-data-of-1500-in-github-breach/)
- [Hackers Breach Meta GitHub Repositories, Steal Source Code and Data of 1,500 People (Cyber Security News)](https://cybersecuritynews.com/hackers-breach-meta-github-repositories/)
- [Meta GitHub Breach: Hackers Steal Code, Data of 1,500 (Cyber Kendra)](https://www.cyberkendra.com/2026/10/meta-github-breach-source-code-1500-employees.html)
- [Hackers stole Meta source code and staff data from its GitHub repos (International Cyber Digest)](https://www.internationalcyberdigest.com/meta-github-breach-source-code-employee-data/)
- [Meta Says Hackers Stole Code and Personal Data of 1,500 Mostly US Employees via Compromised GitHub Repos (AI Weekly)](https://aiweekly.co/alerts/meta-says-hackers-stole-code-and-personal-data-of-1500-mostly-us-employees-via)
- [Meta GitHub breach exposes data of 1,500 people (Cybernews)](https://cybernews.com/security/meta-hack-github-personal-data/)
- [Meta says hackers accessed GitHub repositories using stolen employee credentials (NewsBytes)](https://www.newsbytesapp.com/news/science/meta-says-hackers-accessed-github-repositories-using-stolen-employee-credentials/tldr)
- [Meta GitHub Breach Exposes Code and Data of 1,500 (Tech Journal)](https://techjournal.org/meta-github-data-breach)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3486