--- title: Meta says hackers stole code and data on 1,500 people,... description: Hackers broke into some of Meta's GitHub repositories using an employee's stolen credentials and took data on about 1,500 people, mostly US employees. Business... canonical: https://daily.dev/posts/meta-says-hackers-stole-code-and-data-on-1-500-people-securityweek-reports-05ft58eex twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Meta says hackers stole code and data on 1,500 people, SecurityWeek reports | daily.dev og:description: Hackers broke into some of Meta's GitHub repositories using an employee's stolen credentials and took data on about 1,500 people, mostly US employees. Business... og:url: https://daily.dev/posts/meta-says-hackers-stole-code-and-data-on-1-500-people-securityweek-reports-05ft58eex og:image: https://api.daily.dev/og/posts/05Ft58eeX.png og:image:alt: Meta says hackers stole code and data on 1,500 people, SecurityWeek reports og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Meta says hackers stole code and data on 1,500 people, SecurityWeek reports **[The Next Web](https://daily.dev/sources/tnw)** · 3 min read · 41 upvotes · 3 comments ## Summary Hackers broke into some of Meta's GitHub repositories using an employee's stolen credentials and took data on about 1,500 people, mostly US employees. Business code made up about 99% of the stolen data, with personal data the remaining 1%. That personal data should not have been there, since storing it on GitHub broke company policy, and much of it appears to be synthetic or anonymized test data. Meta detected the intrusion weeks ago, cut off access, rotated exposed secrets, and is now notifying affected people, offering credit and dark web monitoring. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did hackers access Meta's GitHub repositories in the 2026 breach? An outside group used an employee's stolen credentials to access some of Meta's GitHub repositories. Meta detected the intrusion a few weeks before disclosure, cut off the attackers' access, and brought in GitHub and law enforcement to investigate. Notifications to affected individuals began going out on October 13. _Teams hardening repository access controls can track breach patterns like this one on daily.dev._ ### What data did the Meta GitHub breach expose? About 99% of the stolen data was business data, specifically software source code for some Meta products, while personal data made up the remaining 1%. That personal data affected roughly 1,500 people, mostly US-based Meta employees, and should never have been stored in GitHub since it violated company policy. A significant portion of what looked like personal data was actually synthetic or anonymized test data. _Developers auditing what sensitive data ends up in source repos can follow incidents like this on daily.dev._ ### What is Meta doing to prevent user data from leaking into GitHub repositories again? Meta rotated the secrets found in the affected repositories, implemented new controls to prevent user data from being stored in GitHub, and added proactive scanning to catch mistakenly uploaded user data. It is also offering affected individuals credit monitoring and dark web monitoring, and has notified regulators. _Anyone building safeguards against accidental data exposure in repos can follow remediation steps like these on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@petecapecod** · 5 upvotes > Well can't blame them that hard for having a leaked key, that happens. > > But who puts real user data in a freaking repo bro? 🤣 Top tier devs over there lol **@doncho** · 4 upvotes > Beautiful and very satisfying to read. > > No real harm done, I guess, because anyone (me incl.) who's willingly giving data to Meta should always accept that this data is neither private nor theirs anymore. **@andrei0x309** · 1 upvotes > Mostly business date about 1500 Meta employees, there might be a chance that ppl who exfiltrated the data won't bother to try to monetize it, as it doesn't look very valuable. ## Similar posts on daily.dev - [Microsoft pulled 73 GitHub repos after malware attack — but still won’t say who’s compromised](https://daily.dev/posts/microsoft-pulled-73-github-repos-after-malware-attack-but-still-won-t-say-who-s-compromised-klwp4mgla) · The New Stack · 0 upvotes · 0 comments - [Former Meta engineer probed over 30,000 private Facebook photos](https://daily.dev/posts/former-meta-engineer-probed-over-30-000-private-facebook-photos-iakdmkp1a) · The Next Web · 0 upvotes · 0 comments - [Threat Actor Teases Source Code for Sale After Hack of Target Systems](https://daily.dev/posts/threat-actor-teases-source-code-for-sale-after-hack-of-target-systems-2t12qvvjz) · Security Boulevard · 0 upvotes · 0 comments - [Meta admits to Instagram password reset mess, denies leaks](https://daily.dev/posts/meta-admits-to-instagram-password-reset-mess-denies-leaks-gskm0ords) · The Register · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/meta-says-hackers-stole-code-and-data-on-1-500-people-securityweek-reports-05ft58eex) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Meta says hackers stole code and data on 1,500 people, SecurityWeek reports","url":"https://daily.dev/posts/meta-says-hackers-stole-code-and-data-on-1-500-people-securityweek-reports-05ft58eex","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/meta-says-hackers-stole-code-and-data-on-1-500-people-securityweek-reports-05ft58eex"},"datePublished":"2026-10-17T10:03:38.250Z","dateModified":"2026-10-17T10:04:04.411Z","description":"Hackers broke into some of Meta's GitHub repositories using an employee's stolen credentials and took data on about 1,500 people, mostly US employees. Business...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c310e5d58f35bf98fe8f8552563456c7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c310e5d58f35bf98fe8f8552563456c7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":3,"discussionUrl":"https://daily.dev/posts/meta-says-hackers-stole-code-and-data-on-1-500-people-securityweek-reports-05ft58eex","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":41},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":3}],"keywords":"security,github,data-breach","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"Meta says hackers stole code and data on 1,500 people, SecurityWeek reports"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/meta-says-hackers-stole-code-and-data-on-1-500-people-securityweek-reports-05ft58eex","comment":[{"@type":"Comment","text":"Well can’t blame them that hard for having a leaked key, that happens.\nBut who puts real user data in a freaking repo bro? 🤣 Top tier devs over there lol","datePublished":"2026-10-17T14:01:20.790Z","url":"https://daily.dev/posts/05Ft58eeX#c-PznbKzKtm","author":{"@type":"Person","name":"Peter Cruckshank","url":"https://daily.dev/petecapecod","image":"https://media.daily.dev/image/upload/s--ZJhQyKws--/f_auto/v1721235024/avatars/avatar_A9xh33q0QoxtkGoJRCosp"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":5}},{"@type":"Comment","text":"Beautiful and very satisfying to read.\nNo real harm done, I guess, because anyone (me incl.) who’s willingly giving data to Meta should always accept that this data is neither private nor theirs anymore.","datePublished":"2026-10-17T10:45:13.702Z","url":"https://daily.dev/posts/05Ft58eeX#c-NiRTGL9YQ","author":{"@type":"Person","name":"Doncho Angelov","url":"https://daily.dev/doncho","image":"https://media.daily.dev/image/upload/s--j1MSm0hy--/f_auto/v1716369534/avatars/avatar_EB0j0Umzh5v3zGWUSL5ma"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4}},{"@type":"Comment","text":"Mostly business date about 1500 Meta employees, there might be a chance that ppl who exfiltrated the data won’t bother to try to monetize it, as it doesn’t look very valuable.","datePublished":"2026-10-17T15:09:25.878Z","url":"https://daily.dev/posts/05Ft58eeX#c-jD9G8gwXO","author":{"@type":"Person","name":"Andrei O.","url":"https://daily.dev/andrei0x309","image":"https://media.daily.dev/image/upload/f_auto/v1632806353/avatars/1RDGCrVO9"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/meta-says-hackers-stole-code-and-data-on-1-500-people-securityweek-reports-05ft58eex#faq","mainEntity":[{"@type":"Question","name":"How did hackers access Meta's GitHub repositories in the 2026 breach?","acceptedAnswer":{"@type":"Answer","text":"An outside group used an employee's stolen credentials to access some of Meta's GitHub repositories. Meta detected the intrusion a few weeks before disclosure, cut off the attackers' access, and brought in GitHub and law enforcement to investigate. Notifications to affected individuals began going out on October 13. Teams hardening repository access controls can track breach patterns like this one on daily.dev."}},{"@type":"Question","name":"What data did the Meta GitHub breach expose?","acceptedAnswer":{"@type":"Answer","text":"About 99% of the stolen data was business data, specifically software source code for some Meta products, while personal data made up the remaining 1%. That personal data affected roughly 1,500 people, mostly US-based Meta employees, and should never have been stored in GitHub since it violated company policy. A significant portion of what looked like personal data was actually synthetic or anonymized test data. Developers auditing what sensitive data ends up in source repos can follow incidents like this on daily.dev."}},{"@type":"Question","name":"What is Meta doing to prevent user data from leaking into GitHub repositories again?","acceptedAnswer":{"@type":"Answer","text":"Meta rotated the secrets found in the affected repositories, implemented new controls to prevent user data from being stored in GitHub, and added proactive scanning to catch mistakenly uploaded user data. It is also offering affected individuals credit monitoring and dark web monitoring, and has notified regulators. Anyone building safeguards against accidental data exposure in repos can follow remediation steps like these on daily.dev."}}]} ```