The headline number in this story is 1,500. The more useful number is the split Meta attached to it.
What Meta says was taken
Speaking to SecurityWeek, Meta said an outside group got into some of its GitHub repositories with stolen employee credentials and took material that was 99% business data, including software code tied to some of its products. The remaining 1% was personal data. About 1,500 people are being notified, most of them Meta employees in the United States.
Meta says 99% of the stolen material was business data, including software code, and 1% was personal data. It has not explained how those percentages were calculated or identified the personal-data categories. Some material that appeared personal was synthetic or anonymized test data, according to the company. The smaller share matters because personal information was stored in the repositories contrary to Meta's policy, but the percentage alone cannot establish the exposure's severity.
What did not happen, on Meta's account
Meta says the attackers accessed GitHub-hosted repositories through stolen employee credentials, without exploiting a Meta product vulnerability or breaching its internal systems. That account has not been independently verified in the available reporting. Meta has not disclosed how the credentials were stolen, whether multifactor authentication was enabled, which products or repositories were affected, or how many repositories were accessed. Without those details, the security significance of the stolen code remains difficult to assess.
Meta also said, based on its investigation so far with GitHub, that it does not believe the group was specifically targeting Meta.
The response, and what it admits
Meta's response addresses two distinct failures: unauthorized access through stolen credentials and sensitive material stored in repositories where it should not have been. The company says it revoked the attackers' access, rotated exposed secrets, hardened product security and added controls to detect mistakenly uploaded user data. The credential-theft method remains undisclosed, so the sophistication of the initial attack cannot be assessed.
For people receiving a notification, the immediate questions are which information was involved and what protection the offered monitoring services provide. For other Meta users, the company has not reported a broader account compromise arising from this incident. For engineering teams, the case illustrates the importance of repository access controls, secret management and preventing personal data from entering source-code repositories.
Sources
- [1] SecurityWeek, "Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach", 13 October 2026 — primary reporting with a direct Meta spokesperson statement; all figures, the 99%/1% split, the synthetic-data point, the response steps and the no-product-vulnerability position are Meta's, stated to SecurityWeek; paraphrasedRead source
- [2] Cybernews, "Meta GitHub breach exposes data of 1,500 people", 13–14 October 2026 — corroboration; same company figures, monitoring offer, and controls to detect personal data uploaded by mistakeRead source