[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLIswiDX5KSdAPUMMXONaUpbxNx-OVO5STJKblADb6yo":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"1d530296-5262-42e0-9a81-8dc6c99dfcb1","stolen-credentials-expose-metas-github-repos-and-personal-data","00aeed61-856a-4453-832d-fe12d4138d25","Stolen Credentials Expose Meta's GitHub Repos and Personal Data","Hackers leveraged stolen employee credentials to gain unauthorized access to Meta's GitHub repositories, exposing proprietary source code and personal data that had been improperly stored on the platform. The root failure is twofold: inadequate credential protection allowed initial access, and poor data hygiene meant sensitive personal information was unnecessarily present in a code repository. This incident highlights that code repositories are high-value targets that must be treated with the same rigor as production systems. Storing personal or sensitive data in source control is a critical misconfiguration that dramatically escalates the impact of any credential compromise.","**Immediate actions:**\n- Audit all code repositories immediately to identify and remove any stored credentials, secrets, or personal data.\n- Rotate all potentially compromised credentials, API keys, and tokens associated with affected systems.\n- Enforce multi-factor authentication (MFA) on all version control platform accounts without exception.\n\n**Long-term improvements:**\n- Implement secrets management tooling (e.g., HashiCorp Vault, AWS Secrets Manager) to eliminate hardcoded secrets in repositories.\n- Adopt a least-privilege access model for repository permissions, ensuring employees only access repositories required for their role.\n- Establish and enforce a data classification policy that explicitly prohibits storing personal or sensitive data in source control systems.\n\n**Detection measures:**\n- Deploy automated pre-commit scanning tools (e.g., git-secrets, Trufflehog, Gitleaks) to detect and block secrets or personal data before they enter repositories.\n- Enable comprehensive audit logging on all repository activity and alert on anomalous access patterns such as bulk cloning or off-hours access.\n- Conduct regular credential exposure monitoring using services that track leaked credentials on the dark web or public platforms.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 3: Data Protection","CIS Control 16: Application Software Security","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 SI-12: Information Management and Retention","GDPR Article 5(1)(f): Integrity and Confidentiality","GDPR Article 32: Security of Processing","NIST CSF PR.AC-1: Identity and Credential Management","NIST CSF PR.DS-1: Data-at-Rest Protection",{},"published","2026-10-13T18:21:42.190299+00:00","2026-10-13T18:21:42.163+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.securityweek.com\u002Fmeta-says-hackers-took-code-personal-data-of-1500-in-github-breach\u002F","meta-says-hackers-took-code-personal-data-of-1-500-in-github-breach-31360d","Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":40,"name":41,"slug":42,"description":43,"color":44},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":46,"name":47,"slug":48,"description":49,"color":50},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[53,57,61],{"slug":54,"name":55,"problem":56},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":58,"name":59,"problem":60},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":62,"name":63,"problem":64},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files."]