Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach

SecurityWeek reports that, according to the tech giant, an outside group gained access to the repositories using an employee's stolen credentials.[1] SecurityWeek also reports that Meta's security team shut down the attackers' access and brought in GitHub and law enforcement.[1]Meta told SecurityWeek that 99% of the data the hackers took was business data, in the form of software code related to some of its products.[1] According to SecurityWeek, the rest was personal data that had been added to the repositories by mistake and should not have been there, as storing it on GitHub went against company policy.[1]SecurityWeek reports that the company said a significant portion of what looked like personal data was actually synthetic or anonymized test data.[1] SecurityWeek adds that Meta has not said what types of personal information were involved.[1]A Meta spokesperson told SecurityWeek: "This was not a vulnerability in any Meta product, and Meta's internal systems were not breached."[1]According to SecurityWeek, Meta does not believe the hackers were specifically after its data.[1] The outlet also reports that Meta is also notifying regulators[1] and is offering affected people credit and dark web monitoring.Cyber Kendra reports that Meta has not named the attackers, said how the employee's credentials were stolen, or said whether the account was protected by multi-factor authentication.[2]Security Boulevard reports that Meta stated there is no evidence linking its repository breach to other recent industry attacks.[3]