Meta: Hackers Steal Code, Data on 1,500 People
In short: On October 13, 2026, Meta confirmed that attackers breached several of its GitHub repositories using one employee's stolen login credentials, gaining access to internal product source code weeks before the disclosure. Meta estimates that 99% of what was taken was business material — mainly source code — while the remaining 1% was personal data on roughly 1,500 people, mostly US-based employees. The incident wasn't tied to a flaw in Meta's own products: it was a single compromised account on an external platform, not an infrastructure breach.
What happened
According to Meta, an outside group accessed several of the company's GitHub repositories using one employee's stolen login credentials. Meta hasn't disclosed exactly how the credentials were obtained. The intrusion ran for several weeks before it was caught: Meta's internal security team flagged suspicious activity, cut off the attackers' access, and launched an investigation with GitHub and law enforcement. Notifications to affected individuals began going out on October 13, 2026.
What was actually taken
Meta puts the breakdown at 99% "business data" — primarily source code for some of the company's products — and 1% personal data covering roughly 1,500 people. The company says much of what initially looked like personal information turned out to be synthetic or anonymized test data rather than real customer records. User accounts and payment data for Facebook, Instagram, or WhatsApp were not part of this incident — access was limited to internal GitHub repositories.
Why this isn't a flaw in Meta's products
A company representative stressed that the incident wasn't related to a vulnerability in Meta's own infrastructure or products — the breach stemmed from a single compromised account on a third-party development platform. That's a fundamentally different risk than a server hack: an attacker doesn't need to breach a company's perimeter, just obtain one valid work login — through phishing, an infostealer on an employee's personal device, or a leaked password reused from another breached service.
What this means for everyday users
Even if you've never worked at Meta, the story illustrates a general pattern: the weakest link in corporate security usually isn't a server, it's one person holding a valid login. The same vector works against any company and any employee — including you, if you reuse a password across work and personal accounts, since compromising one opens the door to the rest. A useful habit is checking whether your own credentials have already surfaced in public breach dumps, which you can do with our personal data leak checker guide, and storing unique passwords per service with a password manager, covered in how to choose a secure password manager.
A VPN won't protect an account once its password has already been stolen by an infostealer or handed over on a phishing page — those attacks bypass the network layer entirely. But when you log into work or personal accounts over open Wi-Fi at a café, coworking space, or airport, encrypting your connection with LiMP VPN closes a related risk — traffic and login interception on an untrusted network. Plans start at 69 ₽/month — see pricing.