Personally identifiable data of 533M Facebook users has been posted online; Facebook says the data comes from a leak that was reported on and fixed in 2019

- The personal data of over 500 million Facebook users has been posted online in a low-level hacking forum.

Insider 2021-04-05 Aaron Holmes

Context & Ripple Effects

The posting revives a 2019 database of phone numbers linked to Facebook accounts, which Facebook said reflected data collected before it disabled phone-number account lookup. A separate dark-web database affecting mostly US Facebook users showed that such data continued to circulate after the underlying collection issue was addressed.

The newer dataset broadens the visibility of the earlier exposure by making details including phone numbers, names, locations and, in some cases, email addresses available in a low-level hacking forum. Facebook’s position is that the source vulnerability was fixed in 2019, but the copied data remains usable after that fix.

First-order effects

The 533M affected Facebook users face renewed exposure of identifying details now that the dataset has been posted publicly online.
Facebook must defend the adequacy of its 2019 remediation while responding to a data set that includes information beyond phone numbers, as described in the initial report on the 533M-user dataset.

Second-order effects

The recurrence of Facebook-linked databases makes phone numbers and account identifiers more durable inputs for parties assembling or reselling user profiles.
Security teams and users cannot treat closure of the original collection path as closure of the risk: previously copied data can reappear through new distribution channels.

Third-order effects

The episode reinforces a public-data permission boundary in which product features that expose or connect user identifiers can create long-lived downstream data markets even after the feature is changed.
If repeated republication persists, platform privacy controls will be judged not only on whether collection is stopped but on how much identifying data was already made extractable.

The trend: Platform privacy risk is shifting from one-time breach disclosure toward the persistent redistribution of previously collected identity data.

Discussion

@underthebreach Alon Gal on x
All 533,000,000 Facebook records were just leaked for free. This means that if you have a Facebook account, it is extremely likely the phone number used for the account was leaked. I have yet to see Facebook acknowledging this absolute negligence of your data. https://twitter.com…
@liz_shepherd Liz Bourgeois on x
This is old data that was previously reported on in 2019. We found and fixed this issue in August 2019. https://twitter.com/...
@privacymatters @privacymatters on x
More in this thread. 11.5 MILLION individuals affected in the U.K. alone. Hello @ICOnews can we assume you're on the case? https://twitter.com/...
@slpng_giants @slpng_giants on x
Look, beyond the fact that @facebook has touched off an actual genocide and launched a worldwide cult, it needs to be regulated for reasons like this. Until then, there's no recourse for the users they've screwed over. https://www.businessinsider.com/ ...
@charlesarthur Charles Arthur on x
oh no not email addresses https://twitter.com/...
@_mg_ @_mg_ on x
Weird. The data for everyone on the Facebook comms team in this data doesn't look very old. In fact, it looks pretty current! https://twitter.com/...
@violetblue Violet Blue on x
“It had been circulating privately since [at least*] January... includes phone numbers, birth dates, email addresses, locations, other revealing info.” * known date of last harvest using this particular FB security fuckup is August 2019, allegedly fixed then, that's your context …
@alexisgoldstein Alexis Goldstein on x
While Facebook comms is saying this data is from 2019, that doesn't address the fact that it has now been posted online for anyone to see. https://twitter.com/...
@chrismessina @chrismessina on x
Also in the news: yet another massive Facebook leak https://www.techmeme.com/... https://twitter.com/...
@rauschma Axel Rauschmayer on x
Leaked information: “Phone number, Facebook ID, Full name, Location, Past Location, Birthdate, (Sometimes) Email Address, Account Creation Date, Relationship Status, Bio.” 😬 https://twitter.com/...
@samuelstolton Samuel Stolton on x
Facebook maintains tonight that the breach refers to an incident in 2019 that was fixed promptly. Questions remain in terms of notification formalities and necessary GDPR enforcement. https://twitter.com/...
@zackwhittaker Zack Whittaker on x
It doesn't matter if it's old data if it's still relevant. People don't change phone numbers that often. But it is telling that Facebook's first reaction is to try to deflect blame... https://therecord.media/... https://twitter.com/...
@s1guza Siguza on x
Y'know, Facebook should be liable for any and all damages arising from this. For the next 100 years. https://twitter.com/...
@cantabkitty CantabKitty BSc on x
Mock me for having a fake name, phone, and birthday on FB, do you, hmmmm? https://twitter.com/...
@jason_kint Jason Kint on x
😂 @andymstone tries to clean up Facebook's very bad day through a report in Axios but no, having this data leak called “old” in the headline just isn't going to be enough. https://twitter.com/... https://twitter.com/...
@troyhunt Troy Hunt on x
I've had a heap of queries about this. I'm looking into it and yes, if it's legit and suitable for @haveibeenpwned it'll be searchable there shortly. https://twitter.com/...
@willguyatt Will Guyatt on x
I'll be talking about this on the TV and radio over the next few days as this major Facebook leak unfolds https://www.google.co.uk/...
@haveibeenpwned @haveibeenpwned on x
New breach: Facebook had 2.5M addresses exposed in an incident that impacted 533M subscribers' phone numbers. Most records contained name and gender, many also included DoB, location, relationship status and employer. 65% were already in @haveibeenpwned https://www.bleepingcomput…
@rachel_norfolk Rachel Lawson on x
Oh now if there was ever a time where the EU need show some GDPR muscle, this is it... https://twitter.com/...
@jason_kint Jason Kint on x
Yes, Facebook needs heightened regulations *and* antitrust enforcement but worth pointing out we're also here because FTC and Congress were willing to get paid off in 2018/19 rather than deal with the core issues at the company. $5 billion to protect leadership and bury cover-up.…
@ourielohayon Ouriel Ohayon on x
Default assumption : all your private data is not private. Now live your digital life with that in mind. Ps what a disaster https://twitter.com/...
@marshacollier Marsha Collier on x
Personal Data For 533 Million Facebook Users Leaks on the Web 🚨 Spam and robocalls on an uprise? This may be why! 🚨 About 32 million of the users are in the US, while 11 million are from the UK and another 6 million come from India #techradio 📻 https://www.engadget.com/... https:…
@timobrien Tim O'Brien on x
The personal data of more than half a billion Facebook users leaked online for the second time. The leak includes personal information on 533 million users, such as phone numbers, Facebook IDs, full names, locations, birth dates, bios and email addresses. https://www.bloomberg.co…
@nutanc @nutanc on x
So advertisers now dont need to pay Facebook for targeting users? They can just download the data for free? https://twitter.com/...
@troyhunt Troy Hunt on x
That's the email addresses loaded, I'm still considering what to do with the phone numbers https://twitter.com/...
@embedded_iot Lennon on x
But how will we ever find each other! I said to her at the end of the night. That's ok dear, you'll be in the latest FB breach, she replied. My kind of woman. https://twitter.com/...
@adammilstein Adam Milstein on x
.@Facebook claims data from 533 million accounts posted online, including current phone numbers and emails, are no big deal because the hack which was due to their “absolute negligence” took place in 2019 “and issue has been resolved” https://www.businessinsider.com/ ...
@leojtravis10 Joe Ortiz on x
I have to wonder how many shadow profiles (non-Facebook users) have been caught up in this too because remember folks, you can delete Facebook but Facebook doesn't truly delete you. https://twitter.com/...
@karolcummins Karol Cummins on x
A leaker offers info on more than 500M FB users - including phone numbers and other data - virtually for free. Leaked data appeared to be the fruit of a ‘bugfix’ in Aug 2019. FB users should be alert to “social engineering attacks,” by hackers & trolls. https://www.reuters.com/..…
@om @om on x
And to say this shows how callously the company thinks about their users. Basically no accountability for ruining so many people's state of existence. What about all the bullshit that follows the “patching the issue.” https://twitter.com/...
@joshcrumb Josh Crumb on x
Why is it never “source code & internal financial statements have been leaked online” Trillions of BigTech market cap is incentivized to protect their own data & customers, but be negligent with yours ..becoming societal level risk. How does any #ESG fund hold these stocks? $FB h…
@mg_miller Matthew Miller on x
BREAKING: The personal data of more than half a billion Facebook users reemerged for free on a hacking forum Saturday. The trove, which was first leaked in 2019, includes phone numbers and email addresses. https://www.bloomberg.com/...
@ericpresidentvr Eric For President on x
Technically they fixed this in 2019. So we are good, right? 🙃 https://twitter.com/...
@vecchi_paolo Paolo Vecchi on x
Translation: the data of 553M Facebook users, linked to WhatsApp and Instagram, will be shared with more people than planned. https://twitter.com/...
@cnbcjou Joumanna Bercetche on x
This... is a big deal $FB (~20% of monthly active users) https://twitter.com/...
@devruthie Lily Ruth on x
That moment when not putting my real birthday on my socials & using a throwaway email finally came in handy 😝 https://twitter.com/...
@thrilluwu @thrilluwu on x
Ah, a data breach of 1/14th the world population. Very comforting. https://twitter.com/...
@tinashakour @tinashakour on x
Oh ffs. Now my family is going to get even more spam texts — and probably click on them. https://twitter.com/...
@w7voa Steve Herman on x
Personal data of a half billion @Facebook users is now for sale on the cheap to low-level hackers. https://twitter.com/...
@darthsn3ak3rs @darthsn3ak3rs on x
Surprising to almost no one. A lot of these are only matter of time scenarios. Go into it with eyes open and take proper precautions that fit your personal concerns and _your_ threat model. https://twitter.com/...
@mattnavarra @mattnavarra on x
UPDATE: Facebook says big data leak reported today is old data, previously reported on in 2019 https://twitter.com/...
@dynamite7a @dynamite7a on x
@Facebook are you going to notify the users know whose data got leaked atleast ?? https://twitter.com/...
@jangles Neville Hobson on x
Including 11M users in UK. Increased risk of of ID theft. Not seeing any comment yet from #Facebook. https://twitter.com/...
@quinnypig Corey Quinn on x
Users outraged at their data being leaked, Facebook outraged at their data being available for free. https://twitter.com/...
@aralalobo Aral Lobo on x
Well this was expected. Now to see how this plays out. How will it be spun? https://twitter.com/...
@epro Emil Protalinski on x
Facebook is one of the few platforms that I do NOT recommend using 2FA as the pros do not out outweigh the cons. Facebook has abused users' phone numbers before through negligence and through hacks. If you haven't removed your phone number from you Facebook account, do it now. ht…
@1paymentexec Jeff Singleton on x
Facebook doesn't know how or more likely doesn't care about protecting its users info. https://twitter.com/...
@campuscodi Catalin Cimpanu on x
Data is split across 106 parts, divided per country. Here's the list: https://twitter.com/...
@campuscodi Catalin Cimpanu on x
Data includes: -phone numbers -Facebook IDs -profile names -gender -location -job status -and some sort of weird date (maybe profile creation date?) https://twitter.com/...
@roi Roi Carthy on x
Another huge data leak find by @HRock's CTO @UnderTheBreach: https://twitter.com/...
@cathcam Mark Cathcart on x
If you've still got a Facebook ID, hopefully you are not among the 53m but if you are, you can't say you were not warned. But hey don't post pictures of your vaccine card it could be used by scammers.. Ffs #DeleteFacebook https://twitter.com/...
@kickball_diff Kickballdifficulty on x
What is a “low level hacking forum”? Kinda elite tier if they scored this. Is there a Michelin star system for hacking forums? https://twitter.com/...
@ryanmacasero Ryan Macasero on x
I don't even know what to say, man. Zuckerberg, Zuckerberg, Zuckerberg. https://www.businessinsider.com/ ...
@bwjones Bryan William Jones on x
The best time to delete Facebook was yesterday. The next best time is today. https://twitter.com/...
@draglikepull @draglikepull on x
So, uhh, this seems very bad. https://twitter.com/...
@aaronpholmes Aaron Holmes on x
NEW: The phone numbers and personal data of 533 million Facebook users have been leaked in an online hacking forum, as first discovered by @UnderTheBreach https://www.businessinsider.com/ ...
@thisisinsider @thisisinsider on x
The personal data of over 500 million Facebook users has been posted online in a low-level hacking forum. https://www.businessinsider.com/ ...
@daviey Dave Walker on x
Regarding the #FacebookLeak, of the 533M people in the leak - the irony is that Mark Zuckerberg is regrettably included in the leak as well. If journalists are struggling to get a statement from @facebook, maybe just give him a call, from the tel in the leak?
@mikko @mikko on x
Mark Zuckerberg's own data is in the Facebook leak. His Facebook ID number is 4.
@privacyph @privacyph on x
PRESS STATEMENT NPC INVESTIGATING ALLEGED LARGE-SCALE FACEBOOK BREACH #PrivacyPH https://twitter.com/...
@troyhunt Troy Hunt on x
But for spam based on using phone number alone, it's gold. Not just SMS, there are heaps of services that just require a phone number these days and now there's hundreds of millions of them conveniently categorised by country with nice mail merge fields like name and gender.
@jangles Neville Hobson on x
Wow, this #Facebook #databreach scandal is getting global attention if #Techmeme is anything to go by https://www.techmeme.com/... https://twitter.com/...
@fborgesius Frederik Zuiderveen Borgesius on x
Oh, my bad. You shouldn't worry about the data breach. Facebook's Director of “Strategic Response Communications” explains: “We found and fixed this issue in August 2019”. https://twitter.com/...
@privacymatters @privacymatters on x
It seems the Philippines National Privacy Commission is the first data protection authority to announce an investigation into the Facebook data breach, that Facebook comms classes as ‘old data’ https://twitter.com/...
@donie Donie O'Sullivan on x
Cyber experts showed @CNNBusiness the phone numbers of two our senior staff which are included in the database. https://www.cnn.com/...
@troyhunt Troy Hunt on x
So what's the impact? For a targeted attack where you know someone's name and country, it's great for mobile phone lookup. Much harder to do en masse as there's no reliable key; I couldn't take a big list of emails and resolve them to phone numbers as email is rare in the data.
@profcarroll David Carroll on x
@FBoversight 6 Cambridge Analyticas.
@hypervisible @hypervisible on x
Now he can apologize to himself. https://www.businessinsider.com/ ...
@hoooks Hooks on x
Reminder to change your legal names and dates of birth every two years, and manage all your different phone numbers on a reputable site like 1dataleak dot com. https://twitter.com/...
@mikko @mikko on x
Other early facebook users include: ID 11 Soleio Soleio ID 27 Colin Kelly ID 74 Daniel Mejia ID 86 Jason Wen ID 87 Emily Hurd ID 102 Alex Lee ID 104 Amy Ng ID 139 Jeff Winer ID 158 Teresa Grado ID 185 Zach Seward ID 210 Adam Levine ID 287 Peter Buttigieg
@anildash Anil Dash on x
7% of the earth's population has had their phone number or private data exposed in this breach. The fact that the core vulnerability happened in 2019 isn't really pertinent to the impact this will have. https://twitter.com/...
@stollmeyereu @stollmeyereu on x
If this is what Facebook “fixing” things looks like, no wonder Facebook is failing so often. https://twitter.com/...
@chahali Jasusi on x
533 million Facebook users' phone numbers leaked on hacker forum. Somewhere, an OSINT practitioner is publicly decrying the breach of privacy while privately drooling with delight. https://www.bleepingcomputer.com/ ... https://twitter.com/...
@birbigs Mike Birbiglia on x
You know what they always say: if you're not paying for the product...your mother's maiden name is for sale on the dark web. https://twitter.com/...
@thekilcannon Kilcannon on x
This is the kick in the butt I need to finally deactivate my Facebook account. Haven't used it in years, but the single sign-in feature for other sites was a lazy convenience I indulged in. Bye @Facebook! https://twitter.com/...
@ericgarland Eric Garland on x
Hey guys, do you think anyone might scoop up those 533 million “accidentally leaked” Facebook profiles to attack voters in future democratic elections?
@b52malmet Barbara Malmet on x
Hello Mark. https://www.businessinsider.com/ ...
@schandillia Amit Schandillia on x
This man puts physical tapes on his webcam. Think something this paranoid would be “reckless” with his phone number? This is either a sympathy piece, or things are really unsafe on the platform. Either way, get the hell outta there! https://www.businessinsider.com/ ...
@suchitrav Suchitra Vijayan on x
I deactivated my Facebook account last March/ April and a few months later, I deleted my account and left the platform. It was the best decision I have ever made. https://twitter.com/...
@bostonjoan Joan Donovan, PhD on x
This concerns everyone. At the bank and hospital, accessing private records is a matter of answering a few questions (name, email, dob, address, and phone usually is enough). We don't expect strangers to know that information. Identity theft just got a whole lot easier. https://t…
@peterhense Peter Hense on x
Time to show some teeth, regulators! Unless you want to become the suckiest bunch of sucks that ever sucked, @DPCIreland https://twitter.com/...
@ankitlal Ankit Lal on x
Data of over 500 million @Facebook users has been leaked. Includes phone numbers, full names, location, email address, and biographical information. The data could be used by hackers to impersonate people and commit fraud. #FacebookLeak https://www.businessinsider.in/ ...
@danellek Danelle on x
@karolcummins The only way to stop this is to make every company, every state, every political organization, every social media site pay $100 to every victim every time it happens.
@minimike86 @minimike86 on x
The award for the worst response from a facebook employee to a data leak of 500,000,000 facebook users goes to. https://twitter.com/...
@qurtob1 Qurtob on x
@DanelleK @karolcummins Agree, but Zuck can afford $10,000 per leak.
@fboversight @fboversight on x
@Liz_Shepherd @BusinessInsider Thanks for reaching out @Liz_Shepherd. The article is from today - is @BusinessInsider going to be correcting? We would need an independently verified correction to remove the tweet.
@mikko @mikko on x
There are no user IDs 0-3. The only other single-digit user IDs in the leak seem to be: ID 5: Chris Hughes ID 6: Dustin Moskovitz
@dasgeekchannel Das Geek on x
@SleepyPenguin1 @mikko I imagine the response to be something like: “We here at Facebook take privacy very seriously. We're working closely with authorities (which are conveniently stationed in our office already) to figure out who got access to the secret back-doors we built for…
@vickerysec Chris Vickery on x
The world just got FaceF**ked again. https://twitter.com/...
@sci_phile Kyle Hill on x
Another stage of the Infocalypse: An unregulated tech giant just lost the equivalent personal data of the 3rd largest country on Earth. https://twitter.com/...
@mikko @mikko on x
And yes, they all have a phone number listed in the leak. That includes Mr. Zuckerberg. Also, the Winklevoss brothers are not in the leak.
@sanjanah Sanjana Hattotuwa on x
Curiously, no one from #SriLanka or #NewZealand affected but personal details of over 6 million users from #India alone compromised. | Phone numbers for 533 million #Facebook users leaked on hacking forum. https://therecord.media/...
@bascule @bascule on x
Zuck leaked his own PII https://www.businessinsider.com/ ...
@jason_kint Jason Kint on x
Remember, Zuckerberg testified to Congress in 2018 that his information was in the Facebook data sold to Cambridge Analytica for political operations. So nothing new here. And for a cool $5 BIL Zuckerberg was able to eliminate his own personal risk. https://twitter.com/...
@raj_samani Raj Samani on x
“Almost every user record contains a mobile phone number, a Facebook ID, a name, and the member's gender” https://www.bleepingcomputer.com/ ... #facebookleak #cybersecurity #infosec https://twitter.com/...
@msbutterflyyy @msbutterflyyy on x
There's a certain amount of irony in this. Like what goes around comes around. Or what's good for the goose is good for the gander... https://www.businessinsider.com/ ...
@caro_milanesi Carolina Milanesi on x
Not sure if it is the lack of understanding that what was done in 2019 to fix it does not change the fact or the “get over it tone” of the tweet that triggers me more https://twitter.com/...
@mrdenmore Mr Denmore on x
An example here of why the Morrison government's proposal to require people to surrender their passport, drivers licence, Medicare and other personal forms of ID to social media companies before being allowed to post is such a stupid idea https://www.reuters.com/...
@dellcam Dell Cameron on x
Facebook 👇 is attempting to downplay leak now freely available to download, calling it “old data” Just some old data, like the birthdates, phone numbers, and private email accounts of 500+ million people. https://twitter.com/...
@lanceulanoff Lance Ulanoff on x
The personal data of more than half a billion Facebook users reemerged online for free on Saturday, a reminder of the company's ability to collect mountains of information and its struggles to protect these sensitive assets https://www.bloomberg.com/...
@craiggrannell Craig Grannell on x
Old data! Because, as everyone knows, your birthday and phone number change all the time and so it doesn't really matter if Facebook leaks like a sieve. https://twitter.com/...
@kittyhundal @kittyhundal on x
This is why I insist on putting fake info in my bio. Social media sites have no business asking for private info like one's birthday which can be used to commit identity theft. People whose info has been exposed should sue. https://twitter.com/...
@zoeygamez62 @zoeygamez62 on x
@Techmeme @aaronpholmes All this happens while Facebook insists to require an account for their oculus quest 2 and future
@rayredacted @rayredacted on x
This is parody, right ? https://twitter.com/...
@shadow0pz @shadow0pz on x
Congratulations everyone. You location, DOB and phone numbers are “old data” and since they found and fixed this 2 YEARS ago the “old data” should be ignored. Except.... It's not “old data” it's YOUR DATA and they lost 533 Million peoples. Please YEET your company into the sun. h…
@kronykal Kron on x
Fyi. The Facebook data will be searchable by laymen soon. Via https://haveibeenpwned.com/ https://twitter.com/...
@blacklodgeagent Agent Cooper on x
>when you deleted your Facebook 6 years ago https://twitter.com/... https://twitter.com/...
@jonvirtual Jon Oakes on x
Facebook data breach is now being shared and monetized by hackers. (Troy is a good guy) https://twitter.com/...
@dustinpenner25 Dustin Prem-Singh-Penner on x
If you use the same password and email on Facebook as you do for any Crypto exchanges you better hurry up and change everything https://www.businessinsider.com.au/ ...
@simevidas @simevidas on x
I started getting regular spam calls on January 7. So this is why, dang. (https://www.engadget.com/...) https://twitter.com/...
@jesse_squires Jesse Squires on x
next time an interviewer tells you that your coding skills aren't “good enough”, just remember he works at a company full of “very smart people” that just leaked highly sensitive data for half a billion users — and it wasn't the first time https://www.engadget.com/...
@kalske Pivi Kalske on x
Facebook leak includes 1,4 million Finnish users' data by @petterij @digitoday #cybersecurity #socialmedia https://twitter.com/...
@pedrodias Pedro Dias on x
Here we go again... 😑 Facebook Hack: Data on 533 Million Users Is Online for Free - Bloomberg https://www.bloomberg.com/...
@yorukisik @yorukisik on x
Private data compromised: 20,000,000 accounts from Turkey, 10,000,000 accounts from Russia https://twitter.com/...
@asatarbair Dr. Asatar Bair on x
As long as it's a corporation that owns your data rather than the govt, Americans do not see the obvious parallel to Orwell's “1984”. Capitalism harvests all items of value into a few private hands, this is just the latest iteration. Socialism is our only hope https://twitter.com…

Chronicles