Facebook updates a March blog post to say it stored passwords of millions of Instagram users in plain text, not tens of thousands as first announced
This number is much, much bigger than Facebook originally shared. — On the same morning Special Counsel Robert Mueller's report …
Context & Ripple Effects
In late March, Facebook said it would notify hundreds of millions of Facebook users and 'thousands' of Instagram users after finding passwords stored in a readable format, while [[a:939793|Krebs on Security reported the internal figure could run between 200 million and 600 million passwords]], searchable by employees. The revision buried in a March blog post now concedes the Instagram side was off by two orders of magnitude.
The correction landed the same morning as the Mueller report release and ahead of a holiday weekend — CNN frames the timing as a practiced news dump — which matters because the size of the miss, not just the bug itself, is what regulators and plaintiffs will read as a measure of how carefully Facebook counts its own failures.
First-order effects
- Millions of Instagram users join the notification pool Facebook set up in its March announcement, expanding the population entitled to learn their passwords were readable rather than hashed.
- Facebook's own March blog post becomes evidence against it: the company's initial 'tens of thousands' estimate for Instagram is now documented as wrong by a factor of roughly a hundred.
Second-order effects
- Regulators and litigators scrutinizing the plain-text episode gain a concrete credibility argument — an understated disclosure later corrected upward — strengthening claims that Facebook's self-reporting cannot be taken at face value.
- The holiday-weekend release pattern invites every future Facebook incident to be checked against what was disclosed versus what was known internally, raising the cost of each subsequent quiet correction.
Third-order effects
- If the pattern holds — internal estimates far exceeding public figures, corrections slipped into old posts — the plausible endpoint is external audit or mandated reporting standards for breach disclosures at large platforms, replacing voluntary blog-post accounting.
- Password-handling practices across the industry face renewed scrutiny, since Facebook's error was not exotic: storing credentials in a format employees could search is a failure mode any large consumer service could repeat.
The trend: Platform security disclosures are drifting from one-time announcements toward serially revised admissions, with the gap between internal knowledge and public statements becoming the story regulators pursue.