Research note
Research note: Meta says attackers used an employee’s stolen login to copy code from some of its GitHub repositories
How we checked Meta’s GitHub breach disclosure and kept Meta’s own claims separate from reported facts.
What we set out to check
How the attackers got in, what was taken, how many people are affected, and what Meta did.
What we found
- SecurityWeek quotes a Meta spokesperson on the stolen credentials and the small amount of personal data.
- Both sources give the 99% code and 1% personal data split and about 1,500 people notified.
Numbers that differ
SecurityWeek’s summary mentions credit monitoring; its article body says credit and dark-web monitoring. We use the fuller wording.
Labels we chose and why
- Reported for the breach and notification count, carried by two sources.
- Company claim for Meta’s statements on the data split and on products not being vulnerable.
What we could not verify
- A Meta newsroom post or regulator filing.
- Who the attackers were.
What we searched
- Meta GitHub breach 1,500 employees
- Meta stolen credentials repositories personal data
- Meta breach credit monitoring October 2026
Every source we read
| Source | Used? | Why |
|---|---|---|
| SecurityWeek | USED | Primary report with Meta spokesperson statements and actions taken. |
| AI Weekly | USED | Independent summary matching the main figures. |
| Meta newsroom | NOT USED | We did not find a Meta newsroom post about the incident. |