Facebook deleted almost 120 cybercrime private discussion groups, with ~300K members, that ranged from spam to ID theft, hours after tip from Brian Krebs
Brian Krebs / Krebs on Security :
Context & Ripple Effects
In April 2018, Facebook was still treating Groups as a growth product with light-touch oversight — the same year its private messages from 81K accounts leaked for sale, exposing how much sensitive material sat inside the platform's walled features. The cybercrime purge only happened once Brian Krebs tipped the company directly, meaning the ~120 groups and ~300K members survived until an outside researcher did the detection work.
That reactive posture became a recurring pattern: a year later, reporting showed closed Facebook Groups being surfaced and grown by Facebook's own recommendation algorithms, and by 2020 the company was executing mass takedowns like removing 790 QAnon Groups and restricting another 1,950. The Krebs tip is an early data point in Facebook's shift from passive hosting to wholesale group-level enforcement.
First-order effects
- Roughly 300K members across nearly 120 groups lose their coordination venue overnight, disrupting markets for spam, stolen IDs, and related services that had operated inside Facebook's private spaces.
- Facebook's Trust & Safety operation is shown to depend on external researcher tips rather than its own detection pipeline — an immediate credibility problem for its self-policing claims.
Second-order effects
- Cybercrime sellers migrate to platforms without identity graphs or researcher scrutiny, pushing abuse off-Facebook while leaving Facebook holding the reputational cost when leaks like the 81K-account message dump surface.
- Krebs and peers become de facto unpaid moderators, forcing Facebook to either invest in proactive group monitoring or keep absorbing the PR damage of being scooped by outsiders.
Third-order effects
- If the pattern holds, group-level enforcement becomes standard practice — culminating in the 2020-era mass removals of thousands of QAnon and militia Groups — and private communities shift from a growth feature to a liability requiring dedicated detection infrastructure.
- The structural tension between algorithmically recommending private Groups and being unable to observe what happens inside them pushes platforms toward either heavy automated scanning of private content or retreat from group recommendations altogether.
The trend: Platform governance of private groups is moving from reactive, tip-driven deletions toward industrial-scale proactive takedowns, with outside researchers setting the enforcement agenda.