Hackers publish private messages from 81K Facebook accounts, put up to 120M accounts for sale for $0.10/each; Facebook blames third party browser extensions
Hackers appear to have compromised and published private messages from at least 81,000 Facebook users' accounts.
Context & Ripple Effects
This lands five weeks after Facebook disclosed that attackers could take over accounts through three distinct bugs introduced in July 2017, letting them act as the account holder — so the question hanging over this dump is whether it is spillover from that takeover window or, as Facebook claims, a separate compromise via third-party browser extensions.
It also reads as an early data point in a pattern the corpus keeps confirming: a security firm later bought a database of 267M+ mostly US Facebook users' names and phone numbers for £500 on the dark web, and by 2021 data on 533M users was posted openly online.
First-order effects
- At least 81,000 users have their private messages published, with details of up to 120M accounts offered at $0.10 each — direct exposure of personal correspondence, not just profile metadata.
- Facebook's attribution to third-party browser extensions moves the immediate remediation burden onto users running those extensions, while deflecting scrutiny from Facebook's own platform security.
Second-order effects
- A per-account price of $0.10 establishes stolen Facebook credentials as a liquid, commoditized good on underground markets, inviting volume sellers rather than one-off breaches.
- Buyers of bulk social data — spammers, scammers, identity fraud operations — get a cheap feed of names and phone numbers, which is exactly the profile-data format that resurfaces in the later 267M and 533M dumps.
Third-order effects
- If the sequence holds — 81K messages in 2018, 267M records in 2020, 533M in 2021 — Facebook user data behaves like a persistent, repeatedly resold inventory rather than a single breach event, strengthening the case for regulators to treat platform data stewardship as a continuous liability.
- Third-party ecosystem components like browser extensions become a standing attack surface that platforms can blame but cannot fully police, pushing the industry toward stricter vetting of extension-level access to authenticated sessions.
The trend: Facebook's user data is shifting from episodic breach headlines to a continuously traded commodity on dark-web markets, with attribution disputes over entry points masking the recurring scale of exposure.