NEW YORK — Meta Platforms Inc. has confirmed that hackers gained unauthorized access to some of its GitHub repositories, leading to the theft of software source code and personal data affecting approximately 1,500 individuals. The incident, which Meta detected several weeks prior to its public disclosure, prompted the company to begin notifying affected parties on October 13, 2026, according to reports from Cyber Kendra, SecurityWeek, AI Weekly, Times Now, and Techmeme.
The intrusion occurred after an outside group utilized a stolen employee login to access specific GitHub repositories. Meta confirmed the incident to SecurityWeek, detailing that roughly 99% of the compromised material consisted of software code related to Meta products, with the remaining 1% being personal data. The vast majority of the 1,500 individuals impacted are Meta employees based in the United States.
Upon detecting the unauthorized access, Meta’s security team acted swiftly to cut off the attackers’ access. The company also initiated collaboration with GitHub and involved law enforcement agencies to investigate the breach. As a preventative measure, Meta has rotated all digital “secrets” — such as API keys, access tokens, and developer passwords — that were found within the compromised repositories, a standard procedure to mitigate potential further unauthorized access or misuse.
In response to the personal data exposure, Meta is offering credit monitoring and dark web monitoring services to all affected individuals. The company has also informed relevant regulators about the incident, though the specific regulatory bodies notified have not been publicly disclosed. A Meta spokesperson clarified that this incident did not stem from a vulnerability within any Meta product, nor were Meta’s internal systems directly breached. Instead, the event was characterized as improper access to business data that was stored on GitHub, an external code hosting platform widely used by developers.
Meta alleges that the personal data discovered in the repositories was committed by mistake, a violation of the company’s own internal policy against storing such sensitive information on GitHub. Furthermore, Meta claims that a significant portion of what appeared to be personal data was, in fact, synthetic or anonymized test data. This, the company suggests, could complicate efforts for attackers to differentiate between genuine records and fabricated ones, potentially limiting the utility of the stolen personal information.
Based on its ongoing investigation with GitHub, Meta also alleges that the attackers were not specifically targeting Meta itself. This suggests a broader, opportunistic attack rather than a focused campaign against the social media giant. However, the identity of the threat actor group responsible for the attack remains unknown, and Meta has not publicly disclosed how the employee’s credentials were initially stolen.
Several key details about the incident are still unconfirmed or have not been made public. Meta has not disclosed the exact date when the intrusion first began, leaving a window of uncertainty regarding the duration of unauthorized access. The specific Meta products whose source code was compromised have also not been identified by the company. Additionally, Meta has not provided details on the precise kinds of personal information that were involved in the breach, beyond stating it constituted 1% of the stolen material.
The proportion of non-employees among the 1,500 affected individuals is another detail that remains undisclosed. While most are Meta employees, the presence of any external individuals raises further questions about the scope of the data exposure. It is also unknown whether any of the rotated digital secrets were exploited or used by the attackers before they were replaced. Meta has not advised the wider public to take any specific actions in light of this incident, focusing its notifications and mitigation efforts on the directly affected individuals.