Facebook has confirmed that “malicious actors” obtained a dataset containing records of 533 million users by “scraping” public profiles using a vulnerability in the company’s contacts synchronisation tool. The data leaked dates from prior to September 2019 and the vulnerability has since been closed off, said the company in a blog entry posted in response to reports first published by Business Insider. “As a result of the action we took, we are confident that the specific issue that allowed them to scrape this data in 2019 no longer exists,” said Facebook.
According to the report, hundreds of millions of user phone numbers and other details were available in a public database published on a low-level hacking forum. The leaked data includes the personal information of Facebook users from 106 countries, including over 32 million records on users in the US, 11 million on users in the UK, and 6 million on users in India. It includes their phone numbers, Facebook IDs, full names, locations, birthdates, bios, and even email addresses.
Separately, the Irish Data Protection Commission (DPC) issued a statement confirming that it’s in the process of establishing the full details of the leak and that it will communicate further facts as it receives information from Facebook. It warned that there are risks affected users may be spammed for marketing purposes and that they need to be especially vigilant in relation to any services they use that require authentication using a person’s phone number or email address in case third parties are attempting to gain access.
