/
Navigation
Chronicles
Browse all articles
Explore
Semantic exploration
Research
Entity momentum
Nexus
Correlations & relationships
Story Arc
Topic evolution
Drift Map
Semantic trajectory animation
Posts
Analysis & commentary
Pulse API
Tech news intelligence API
Browse
Entities
Companies, people, products, technologies
Domains
Browse by publication source
Handles
Browse by social media handle
Detection
Concept Search
Semantic similarity search
High Impact Stories
Top coverage by position
Sentiment Analysis
Positive/negative coverage
Anomaly Detection
Unusual coverage patterns
Analysis
Rivalry Report
Compare two entities head-to-head
Semantic Pivots
Narrative discontinuities
Crisis Response
Event recovery patterns
Connected
Search: /
Command: ⌘K
Embeddings: large
TEXXR ▲
TEXXR

Chronicles

The story behind the story

← → days · ↑ ↓ browse · Enter similar · o open

Facebook says it discovered a security issue, now patched, on September 25 affecting ~50M users that let hackers steal access tokens and take over user accounts

On the afternoon of Tuesday, September 25, our engineering team discovered a security issue affecting almost 50 million accounts.

Facebook Guy Rosen

Context & Ripple Effects

Facebook's disclosure closes a two-week window: per the company's own follow-up reporting, the vulnerability stemmed from three distinct bugs introduced in July 2017, and the attack ran from September 14 until the September 25 patch. The initial estimate of ~50M exposed accounts was later narrowed when Facebook's first investigation results found a large-scale attack had accessed information of about 29M people.

First-order effects

  • Roughly 50M Facebook users had their access tokens stolen, letting attackers use their accounts as if they were the account holders; Facebook's response was to invalidate those tokens and force re-authentication.

Second-order effects

  • The investigation's finding that other Facebook apps and third-party apps were not affected contains the blast radius for developers who rely on Facebook identity — but it also puts Facebook's token architecture itself under scrutiny as the single point of failure.

Third-order effects

  • If one set of bugs can expose tens of millions of sessions for over a year undetected, platform-scale identity systems will face pressure to treat token issuance and validation as a hardened security boundary rather than an internal implementation detail.

The trend: As social platforms concentrate login and identity for hundreds of millions of users, single code-level flaws are becoming mass account-takeover events measured in tens of millions of sessions.

Related: Model access as a security boundary · Facebook · ~50M · Vulnerability was the result of 3 distinct bugs introduced in July 2017 · First results of breach investigation: ~29M people's info accessed

Related Coverage