How the security breach that made 50M Facebook accounts vulnerable to takeover worked and what information may have been accessed
FACEBOOK'S PRIVACY PROBLEMS severely escalated Friday when the social network disclosed that an unprecedented security issue, discovered September 25, impacted almost 50 million user accounts.
Context & Ripple Effects
Facebook disclosed on September 25 that it had found and patched a flaw letting attackers steal access tokens and take over user accounts, with almost 50 million accounts exposed. Motherboard's reporting traced the vulnerability to three distinct bugs introduced in July 2017 — meaning the hole sat in production for over a year before detection.
The story then narrowed: Facebook's follow-up investigation concluded a large-scale attack ran September 14–27 and accessed information of about 29 million people, while ruling out impact on other Facebook apps or third-party apps. That scoping matters because access tokens are the credential layer third-party integrations ride on.
First-order effects
- Roughly 50 million Facebook users faced potential account takeover, since stolen access tokens let attackers operate accounts as if they were the account holder — no password needed.
- Facebook forced the patch and invalidated the compromised tokens, and its own investigation became the primary source for who was actually hit, with TechCrunch publishing user-facing guidance on checking exposure.
Second-order effects
- Because tokens grant account-holder-level access, every service that authenticates through Facebook had to verify whether its users' sessions were compromised — the finding that third-party apps were unaffected contained what could have been a cascade across the connected-app ecosystem.
- Regulatory pressure on Facebook intensifies: the FTC already attributes a large share of social-media scam losses to the platform, and a year-long undetected token-stealing bug gives regulators a concrete failure case for oversight arguments.
Third-order effects
- The breach shifts the security conversation from password theft to session-token theft: when a single stolen token equals full identity, platforms face structural pressure to treat token issuance, lifetime, and revocation as their primary security boundary.
- If large platforms keep disclosing multi-year-old bugs found only after exploitation, expect regulators and enterprise buyers to demand shorter disclosure timelines and independent verification rather than self-reported investigations.
The trend: Platform security is moving from protecting passwords to protecting access tokens as the real identity boundary, with breach disclosures increasingly scoped by token reach rather than account counts.