Meta is notifying around 1,500 people, most of them employees in the US, that their personal data was compromised after hackers broke into some of the company’s GitHub repositories.
The break-in was discovered a few weeks ago. According to the tech giant, an outside group gained access to the repositories using an employee’s stolen credentials.
Meta’s security team blocked the attackers’ access and involved GitHub and law enforcement. Notifications have been sent to those affected since Tuesday.
Meta told Safety Week that 99% of the data captured by the hackers was business data in the form of software code related to some of its products. The remaining 1% was personal data.
This personal data was accidentally added to the repositories and should not have been there because storing it on GitHub violated company policy. Meta did not say what types of personal data were involved.
The company also discovered that a significant portion of the seemingly personal data was actually synthetic or anonymized test data. Therefore, the attackers may not be able to easily distinguish real recordings from test data.
Based on the previous investigation with GitHub, Meta does not believe that the hackers were specifically after his data.
Meta also notifies regulators and credit and dark web monitoring services are offered to those whose information was affected.
“This was not a vulnerability in any Meta product and Meta’s internal systems were not breached. Meta business data stored in a GitHub repository was improperly accessed using an employee’s stolen credentials – this included a small amount of personal information for a limited number of people, most of whom were Meta employees,” a Meta spokesperson said Safety Week.
In response to the incident, Meta rotated the secrets found in the affected repositories. In addition, the company has strengthened its product security to address the risks arising from access to its business data.
The company is working with its teams using GitHub to keep user data off the platform. As a second line of defense, proactive scanning controls are added to detect accidentally uploaded user data.
“Since then, we have rotated secrets found in the repositories, implemented new controls to prevent user data from being stored in GitHub, and worked with GitHub on additional measures to protect our repositories,” the spokesperson said.
Related: Cyberattack prompts Ahold Delhaize to disconnect systems
Related: Refrigeration controller hack spoils food in European supermarkets
Related: At least 360,000 people are affected by the iRhythm data breach
