Personally identifiable data of 533M Facebook users has been posted online; Facebook says the data comes from a leak that was reported on and fixed in 2019

- The personal data of over 500 million Facebook users has been posted online in a low-level hacking forum.

Insider 2021-04-04 Aaron Holmes

Context & Ripple Effects

Facebook had already disabled phone-number account lookup after a database linking 419M phone numbers to accounts surfaced in 2019. Yet a separate database of mostly US users was being sold in 2020, showing that historical Facebook data could continue circulating after the underlying access route changed.

The newly posted 533M-user dataset extends that pattern: Facebook frames it as a fixed 2019 issue, while the public availability of the records makes the remediation boundary more consequential for affected users.

First-order effects

The records of 533M Facebook users are now available on a low-level hacking forum, exposing phone numbers and other listed profile data beyond Facebook's control.
Facebook must defend its position that the dataset originated from a previously reported and fixed flaw, rather than a newly disclosed breach.

Second-order effects

The recurrence of a 267M-user database offered on the dark web weakens the practical value of a product fix when previously collected data can be repackaged and redistributed.
Facebook users whose information appears in multiple historical datasets face a more durable exposure than a single incident, while Facebook absorbs the trust cost of data remaining available after the access method was closed.

Third-order effects

The episode reinforces a public-data permission boundary in which limiting a platform feature does not retrieve data already collected through it; durable safeguards must account for downstream circulation as well as initial access.
If repeated releases persist, accountability for large platforms will increasingly center on the lifetime of data exposed by product design, not solely on whether the original flaw was patched.

The trend: Large-platform privacy risk is shifting from one-time breach disclosure toward the long-tail redistribution of datasets collected before access controls changed.

Discussion

@underthebreach Alon Gal on x
All 533,000,000 Facebook records were just leaked for free. This means that if you have a Facebook account, it is extremely likely the phone number used for the account was leaked. I have yet to see Facebook acknowledging this absolute negligence of your data. https://twitter.com…
@liz_shepherd Liz Bourgeois on x
This is old data that was previously reported on in 2019. We found and fixed this issue in August 2019. https://twitter.com/...
@privacymatters @privacymatters on x
More in this thread. 11.5 MILLION individuals affected in the U.K. alone. Hello @ICOnews can we assume you're on the case? https://twitter.com/...
@slpng_giants @slpng_giants on x
Look, beyond the fact that @facebook has touched off an actual genocide and launched a worldwide cult, it needs to be regulated for reasons like this. Until then, there's no recourse for the users they've screwed over. https://www.businessinsider.com/ ...
@charlesarthur Charles Arthur on x
oh no not email addresses https://twitter.com/...
@_mg_ @_mg_ on x
Weird. The data for everyone on the Facebook comms team in this data doesn't look very old. In fact, it looks pretty current! https://twitter.com/...
@violetblue Violet Blue on x
“It had been circulating privately since [at least*] January... includes phone numbers, birth dates, email addresses, locations, other revealing info.” * known date of last harvest using this particular FB security fuckup is August 2019, allegedly fixed then, that's your context …
@alexisgoldstein Alexis Goldstein on x
While Facebook comms is saying this data is from 2019, that doesn't address the fact that it has now been posted online for anyone to see. https://twitter.com/...
@chrismessina @chrismessina on x
Also in the news: yet another massive Facebook leak https://www.techmeme.com/... https://twitter.com/...
@rauschma Axel Rauschmayer on x
Leaked information: “Phone number, Facebook ID, Full name, Location, Past Location, Birthdate, (Sometimes) Email Address, Account Creation Date, Relationship Status, Bio.” 😬 https://twitter.com/...
@samuelstolton Samuel Stolton on x
Facebook maintains tonight that the breach refers to an incident in 2019 that was fixed promptly. Questions remain in terms of notification formalities and necessary GDPR enforcement. https://twitter.com/...
@zackwhittaker Zack Whittaker on x
It doesn't matter if it's old data if it's still relevant. People don't change phone numbers that often. But it is telling that Facebook's first reaction is to try to deflect blame... https://therecord.media/... https://twitter.com/...
@s1guza Siguza on x
Y'know, Facebook should be liable for any and all damages arising from this. For the next 100 years. https://twitter.com/...
@cantabkitty CantabKitty BSc on x
Mock me for having a fake name, phone, and birthday on FB, do you, hmmmm? https://twitter.com/...
@jason_kint Jason Kint on x
😂 @andymstone tries to clean up Facebook's very bad day through a report in Axios but no, having this data leak called “old” in the headline just isn't going to be enough. https://twitter.com/... https://twitter.com/...
@troyhunt Troy Hunt on x
I've had a heap of queries about this. I'm looking into it and yes, if it's legit and suitable for @haveibeenpwned it'll be searchable there shortly. https://twitter.com/...
@willguyatt Will Guyatt on x
I'll be talking about this on the TV and radio over the next few days as this major Facebook leak unfolds https://www.google.co.uk/...
@haveibeenpwned @haveibeenpwned on x
New breach: Facebook had 2.5M addresses exposed in an incident that impacted 533M subscribers' phone numbers. Most records contained name and gender, many also included DoB, location, relationship status and employer. 65% were already in @haveibeenpwned https://www.bleepingcomput…
@rachel_norfolk Rachel Lawson on x
Oh now if there was ever a time where the EU need show some GDPR muscle, this is it... https://twitter.com/...
@jason_kint Jason Kint on x
Yes, Facebook needs heightened regulations *and* antitrust enforcement but worth pointing out we're also here because FTC and Congress were willing to get paid off in 2018/19 rather than deal with the core issues at the company. $5 billion to protect leadership and bury cover-up.…
@ourielohayon Ouriel Ohayon on x
Default assumption : all your private data is not private. Now live your digital life with that in mind. Ps what a disaster https://twitter.com/...
@marshacollier Marsha Collier on x
Personal Data For 533 Million Facebook Users Leaks on the Web 🚨 Spam and robocalls on an uprise? This may be why! 🚨 About 32 million of the users are in the US, while 11 million are from the UK and another 6 million come from India #techradio 📻 https://www.engadget.com/... https:…
@timobrien Tim O'Brien on x
The personal data of more than half a billion Facebook users leaked online for the second time. The leak includes personal information on 533 million users, such as phone numbers, Facebook IDs, full names, locations, birth dates, bios and email addresses. https://www.bloomberg.co…
@nutanc @nutanc on x
So advertisers now dont need to pay Facebook for targeting users? They can just download the data for free? https://twitter.com/...
@troyhunt Troy Hunt on x
That's the email addresses loaded, I'm still considering what to do with the phone numbers https://twitter.com/...
@embedded_iot Lennon on x
But how will we ever find each other! I said to her at the end of the night. That's ok dear, you'll be in the latest FB breach, she replied. My kind of woman. https://twitter.com/...
@adammilstein Adam Milstein on x
.@Facebook claims data from 533 million accounts posted online, including current phone numbers and emails, are no big deal because the hack which was due to their “absolute negligence” took place in 2019 “and issue has been resolved” https://www.businessinsider.com/ ...
@leojtravis10 Joe Ortiz on x
I have to wonder how many shadow profiles (non-Facebook users) have been caught up in this too because remember folks, you can delete Facebook but Facebook doesn't truly delete you. https://twitter.com/...
@karolcummins Karol Cummins on x
A leaker offers info on more than 500M FB users - including phone numbers and other data - virtually for free. Leaked data appeared to be the fruit of a ‘bugfix’ in Aug 2019. FB users should be alert to “social engineering attacks,” by hackers & trolls. https://www.reuters.com/..…
@om @om on x
And to say this shows how callously the company thinks about their users. Basically no accountability for ruining so many people's state of existence. What about all the bullshit that follows the “patching the issue.” https://twitter.com/...
@joshcrumb Josh Crumb on x
Why is it never “source code & internal financial statements have been leaked online” Trillions of BigTech market cap is incentivized to protect their own data & customers, but be negligent with yours ..becoming societal level risk. How does any #ESG fund hold these stocks? $FB h…
@mg_miller Matthew Miller on x
BREAKING: The personal data of more than half a billion Facebook users reemerged for free on a hacking forum Saturday. The trove, which was first leaked in 2019, includes phone numbers and email addresses. https://www.bloomberg.com/...
@ericpresidentvr Eric For President on x
Technically they fixed this in 2019. So we are good, right? 🙃 https://twitter.com/...
@vecchi_paolo Paolo Vecchi on x
Translation: the data of 553M Facebook users, linked to WhatsApp and Instagram, will be shared with more people than planned. https://twitter.com/...
@cnbcjou Joumanna Bercetche on x
This... is a big deal $FB (~20% of monthly active users) https://twitter.com/...
@devruthie Lily Ruth on x
That moment when not putting my real birthday on my socials & using a throwaway email finally came in handy 😝 https://twitter.com/...
@thrilluwu @thrilluwu on x
Ah, a data breach of 1/14th the world population. Very comforting. https://twitter.com/...
@tinashakour @tinashakour on x
Oh ffs. Now my family is going to get even more spam texts — and probably click on them. https://twitter.com/...
@w7voa Steve Herman on x
Personal data of a half billion @Facebook users is now for sale on the cheap to low-level hackers. https://twitter.com/...
@darthsn3ak3rs @darthsn3ak3rs on x
Surprising to almost no one. A lot of these are only matter of time scenarios. Go into it with eyes open and take proper precautions that fit your personal concerns and _your_ threat model. https://twitter.com/...
@mattnavarra @mattnavarra on x
UPDATE: Facebook says big data leak reported today is old data, previously reported on in 2019 https://twitter.com/...
@dynamite7a @dynamite7a on x
@Facebook are you going to notify the users know whose data got leaked atleast ?? https://twitter.com/...
@jangles Neville Hobson on x
Including 11M users in UK. Increased risk of of ID theft. Not seeing any comment yet from #Facebook. https://twitter.com/...
@quinnypig Corey Quinn on x
Users outraged at their data being leaked, Facebook outraged at their data being available for free. https://twitter.com/...
@aralalobo Aral Lobo on x
Well this was expected. Now to see how this plays out. How will it be spun? https://twitter.com/...
@epro Emil Protalinski on x
Facebook is one of the few platforms that I do NOT recommend using 2FA as the pros do not out outweigh the cons. Facebook has abused users' phone numbers before through negligence and through hacks. If you haven't removed your phone number from you Facebook account, do it now. ht…
@1paymentexec Jeff Singleton on x
Facebook doesn't know how or more likely doesn't care about protecting its users info. https://twitter.com/...
@campuscodi Catalin Cimpanu on x
Data is split across 106 parts, divided per country. Here's the list: https://twitter.com/...
@campuscodi Catalin Cimpanu on x
Data includes: -phone numbers -Facebook IDs -profile names -gender -location -job status -and some sort of weird date (maybe profile creation date?) https://twitter.com/...
@roi Roi Carthy on x
Another huge data leak find by @HRock's CTO @UnderTheBreach: https://twitter.com/...
@cathcam Mark Cathcart on x
If you've still got a Facebook ID, hopefully you are not among the 53m but if you are, you can't say you were not warned. But hey don't post pictures of your vaccine card it could be used by scammers.. Ffs #DeleteFacebook https://twitter.com/...
@kickball_diff Kickballdifficulty on x
What is a “low level hacking forum”? Kinda elite tier if they scored this. Is there a Michelin star system for hacking forums? https://twitter.com/...
@ryanmacasero Ryan Macasero on x
I don't even know what to say, man. Zuckerberg, Zuckerberg, Zuckerberg. https://www.businessinsider.com/ ...
@bwjones Bryan William Jones on x
The best time to delete Facebook was yesterday. The next best time is today. https://twitter.com/...
@draglikepull @draglikepull on x
So, uhh, this seems very bad. https://twitter.com/...
@aaronpholmes Aaron Holmes on x
NEW: The phone numbers and personal data of 533 million Facebook users have been leaked in an online hacking forum, as first discovered by @UnderTheBreach https://www.businessinsider.com/ ...
@thisisinsider @thisisinsider on x
The personal data of over 500 million Facebook users has been posted online in a low-level hacking forum. https://www.businessinsider.com/ ...

Chronicles