Meta is notifying approximately 1,500 people following unauthorized access to GitHub repositories. The company confirms that the attackers used login information they obtained from an employee. Data held on GitHub’s developer platform includes source code and accidentally uploaded personal information. The majority of those affected are Meta employees in the United States. However, the statement does not state that there is a security vulnerability in Meta products or that the company’s internal systems have been entered.
Meta explains that it detected the breach a few weeks ago and cut off the attackers’ access. In addition, the company is conducting an investigation together with GitHub and involving law enforcement authorities in the process. Notifications began going out to affected individuals on October 13. Meta also notifies relevant regulatory authorities.
According to the distribution given by the company, 99 percent of the data received consists of commercial data, mainly software codes related to products. On the other hand, 1 percent consists of personal information and these rates do not give the number of affected people or the total file size received. With approximately 1,500 people, the expression 1 percent describes two different measurements.
Meta states that personal information in the repositories was uploaded by mistake, contrary to company rules. In addition, he explains that a significant portion of records that appear to be personal data are synthetic or anonymized test data. The company does not specify which types of personal information are affected and provides credit and illegal data sharing monitoring services to those affected.
Access information in source repositories requires protection separately from code
Meta explains that it has revamped the confidential access information it found in the affected repositories and added controls to prevent accidental uploading of user data. Access credentials here don’t just have to be the same as an employee’s login password. Keys belonging to other services contained in the source code may also pose a separate risk.
GitHub’s private information scan looks for information written into code, such as API keys, passwords, and access tokens. The system not only examines current files, but also scans the history in all branches of the repository. Additionally, it rechecks the repositories when new types of confidential information are added. Thus, the fact that information removed from a file remains in old versions is also within the scope of evaluation.
GitHub recommends renewing or invalidating the relevant access information when detecting a leak. The renewal step announced by Meta also aims to reduce the risk of such access. However, the publicly disclosed information does not show how the attackers obtained the employee’s login information. To understand the scope of the incident, it is necessary to evaluate verified repository access and the undisclosed attack method separately.