Hackers took Meta code from GitHub. The way in was one employee's stolen login.
By Lior AharonovFounder, 7IT Solutions ·
Meta says an outside group used an employee's stolen credentials to reach some of its GitHub repositories, per SecurityWeek on 13 October 2026. About 99 percent of the data was business data, mostly code, and the rest was personal data stored there by mistake, against company policy. About 1,500 people, mostly US employees, are being notified, and Meta says no Meta product flaw was involved.
Your repositories hold code and, as Meta found out, sometimes personal data nobody meant to put there. One stolen login is all it takes to read both.
Turn on multi-factor sign-in for every GitHub account in your organization, and scan your repositories for committed secrets and personal data. Rotate any secret you find, as Meta did.
A company with Meta's security budget lost repositories the way a small agency would. One stolen login was enough.
Lior Aharonov · my takeSources
Researched with AI tools; every fact is checked against the linked sources.