InfoSecBulletin Cybersecurity for mankind
Meta is informing about 1,500 people—mainly employers in the US, that their personal data was affected after hackers broke into some GitHub accounts of the company. The break-in was spotted a few weeks back. The tech company said that an outside group got into the data using an employee’s stolen login details.
Meta’s security team shut down the attackers’ access and brought in GitHub and law enforcement. Notifications to the impacted individuals started going out on Tuesday.
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Meta told SecurityWeek that 99% of the data the hackers took was business data, in the form of software code related to some of its products. The remaining 1% was personal data.
That personal data had been added to the repositories by mistake and should not have been there, as storing it on GitHub went against company policy. Meta has not said what types of personal information were involved.
The company said that much of what seemed like personal data was really fake or anonymous test data. So, the attackers might not easily tell real records from test data.
Based on its investigation with GitHub so far, Meta does not believe the hackers were specifically after its data.
Meta is also notifying regulators, and the people whose information was involved are being offered credit and dark web monitoring services.
“This was not a vulnerability in any Meta product, and Meta’s internal systems were not breached. Meta business data held in a GitHub repository was improperly accessed using an employee’s stolen credentials – this included a small amount of personal data for a limited number of people, most of whom were Meta employees,” a Meta spokesperson told SecurityWeek.
In response to the incident, Meta rotated secrets it found in the affected repositories. It also hardened its product security to address risks stemming from access to its business data.
The company is helping its teams that use GitHub to keep user data safe. As an extra step, it is adding tools to check for any user data that might have been uploaded by accident.
“We’ve since rotated secrets found in the repositories, implemented new controls to prevent user data from being stored in GitHub, and worked with GitHub on additional measures to protect our repositories,” the spokesperson said.
