Facebook says the leaked 533M records are a different data set that attackers created by abusing a flaw in a Facebook contacts import feature, not by hacking

The company's explanations have been confusing and inconsistent, but there are finally some answers.

Wired 2021-04-07 Lily Hay Newman

Context & Ripple Effects

Facebook’s account-security history includes a 2018 vulnerability that exposed 50M accounts to takeover, making the company’s distinction between a hack and feature abuse consequential rather than semantic. The immediate issue is whether the contacts-importer weakness enabled large-scale collection without an account takeover.

Related reporting soon challenged the company’s framing, with researchers saying similar contact-importer exploits had been known for years. That turns the story from a one-off explanation into a question of how Facebook handled a recurring abuse path.

First-order effects

Facebook must defend both the contacts-importer design and its initially confusing explanation of how records tied to 533M users were obtained.
People represented in the leaked data set face exposure from records collected through the importer flaw even though Facebook says no hack occurred.

Second-order effects

Researchers’ account of a long-known exploit increases pressure on Facebook to show that its safeguards address systematic scraping, not only unauthorized account access.
Facebook’s distinction between hacking and feature abuse risks narrowing its incident response in a way that conflicts with how affected users experience the data exposure.

Third-order effects

The paired record of importer abuse and the earlier account-takeover flaw points toward platform-security accountability centered on abuse-resistant feature design, rather than breach labels alone.
If recurring feature exploits continue to surface after disclosure, external scrutiny will increasingly evaluate Facebook on remediation history and product safeguards, not just on whether attackers penetrated its systems.

The trend: Large platforms are being judged more on whether product features can be systematically abused to collect user data than on the narrower question of whether a conventional hack occurred.

Discussion

@ashk4n Ashkan Soltani on x
Facebook confirms that a sample of the 533M data is related to a ‘contact importers vulnerability’ which was fixed in Aug 2019 While there was some reporting of a ‘contact importer vuln’ in 2019, @Facebook never actually disclosed any details or notified affected users (1/6) http…
@carolecadwalla Carole Cadwalladr on x
I've been tweeting about latest Facebook breach because it seems to show it's learned nothing since Cambridge Analytica. It's refused to answer basic press inquiries. And now, it's pulled out rest of Cambridge Analytica playbook. This isn't FB's fault. It's ‘malicious actors’ 1/ …
@carolecadwalla Carole Cadwalladr on x
It took Facebook 5 days to publish this. It's refusing to even acknowledge journalists's qs. It doesn't appear to be cooperating with the regulator. And these are not ‘facts’. This is a high-stakes PR op that blames Facebook's users for their shocking failure to protect them http…
@abiaad Pierre Abi-aad on x
My #Facebook account is closed and removed since 2015 but my phone number is part a data breach fixed in 2019. This is fucking scary. #privacy #breach https://twitter.com/...
@daviey Dave Walker on x
In another turn of events, Mark Zuckerberg also respects his own privacy, by using a chat app that has end-to-end encryption and isn't owned by @facebook This is the number associated with his account from the recent facebook leak. https://twitter.com/...
@ashk4n Ashkan Soltani on x
Not only is @Facebook past the indemnification period of the FTC settlement (June 12 2019), they also may have violated the terms of the settlement requiring them to report breaches of covered information (ht @JustinBrookman ) https://www.ftc.gov/... https://twitter.com/...
@ashk4n Ashkan Soltani on x
Importantly, my expectation is @Facebook will argue that they didn't disclose non-public information since they never ‘disclosed the phone number’ It's the attacker that provides the number in an enumeration/dictionary attack. e.g.(000)000-0000 -> (999)999-9999 (4/6) https://twit…
@carolecadwalla Carole Cadwalladr on x
This isn't just chutzpah or an Orwellian disregard for language. This is high high stakes. @ashk4n is the former CTO of the FTC - the body which fined Facebook a record $5bn - & he points out the timing of this breach looks really really bad for Facebook 4/ https://twitter.com/..…
@ashk4n Ashkan Soltani on x
.@Facebook statement: Yet another vuln in Contact Importer which was present until Sept 2019 Importantly @Facebook is attempting to frame it as ‘not hacking’ to avoid liability for failing to properly safeguard users' data (eg. by employing rate-limits) https://www.wired.com/... …
@ashk4n Ashkan Soltani on x
That said, focusing on ‘data sets’ is a red herring The important questions are: 1) Which specific vulns were exploited to access this data & how long were they active? 2) When did @Facebook disclose details of this vulnerability (incl to @FTC) & did they notify affected users?
@justinbrookman Justin Brookman on x
Did y'all remember to report this to the FTC as required by your latest settlement agreement with them? https://www.ftc.gov/... https://twitter.com/... https://twitter.com/...
@samuelstolton Samuel Stolton on x
Overnight, Facebook posted a blog piece on #533 breach. They maintain it relates to the 2019 contact importer vulnerability. Last paragraph will get them in hot water through - sounds as if they are trying to pass the buck: https://about.fb.com/... https://twitter.com/...
@jason_kint Jason Kint on x
They did this with Cambridge Analytica. In fact, upon discovery, they claimed there were reported scraping behaviors that they knew about and did nothing but those were entirely different than the data harvesting techniques which they didn't know about but then covered up. 🤦🏽‍♀ ️…
@tomwarren Tom Warren on x
Facebook blames the data theft affecting 530 million accounts on scraping, not hacking. Notice how this statement doesn't include an apology at all. https://twitter.com/...
@ashk4n Ashkan Soltani on x
Screenshots are from @lilyhnewman's @wired piece — which is the first to shine light onto the inconsistent statements @fbnewsroom gave in an attempt to spin this story and not admit that this breach wasn't previously disclosed. https://www.wired.com/...
@tupp_ed Simon McGarr on x
Interesting. Facebook's statement tonight acknowledges that this data continued to leak to Sept 2019. Unlike the PR from @DPCIreland earlier that “Because the scraping took place prior to GDPR, Facebook chose not to notify this as a personal data breach.. https://about.fb.com/...
@alliecoyne Allie on x
Facebook continually demonstrates it does not care one iota about your privacy. It is making millions off your data whilst doing little to protect it. Here's how you can delete your account https://www.facebook.com/... https://twitter.com/...
@privacymatters @privacymatters on x
And now Facebook issues a statement of ‘facts’ saying the data was ‘scraped’ prior to September 2019 but a few days ago told the @DPCIreland it ‘seemed’ to be ‘pre-GDPR’ from 2017/18 https://dataprotection.ie/... So why didn't FB tell users and tell EU DPAs @eu_edpb ? #FacebookBr…
@jason_kint Jason Kint on x
Wow, this is some next-level BS even for Facebook. Their excuse is the equivalent to arguing that if I provide social security numbers to a bank and the bank gives me names for each of them then the bank didn't actually reveal any social security #s. 🤦🏽‍♀ ️ https://www.wired.com/…
@mylesudland Myles Udland on x
Is this an Impact point? https://about.fb.com/... https://twitter.com/...
@bostonjoan Joan Donovan, PhD on x
If only there was like a large bureaucracy or something that is supposed to hold the powerful to account and get to the bottom of things like this because that large bureaucracy is staffed by representatives of the public and are sworn to protect their rights... if only! https://…
@fboversight @fboversight on x
“I guess this is further evidence that @Facebook should be regulated like a utility.... They've already become the de-facto ‘phone book’ provider regardless of whether users want to be listed or not...” 👏👏👏@ashk4n https://twitter.com/...
@richontech Rich DeMuro on x
Facebook weighs in on the data breach, says the data was obtained by people abusing their contact import system and the hole has since been patched https://twitter.com/...
@troyhunt Troy Hunt on x
Statement from Facebook on this incident: “Scraping data using features meant to help people violates our terms”. Well that fixes that! https://about.fb.com/...
@okeefekat Katherine O'Keefe, PhD on x
So... according to Facebook's public statements to the press, they had two separate notifiable breaches in 2019. According to the @DPCIreland, “ It received no proactive communication from Facebook” (ie. they did not notify them of the breaches). https://dataprotection.ie/... htt…
@adrianweckler Adrian Weckler on x
Facebook finally addresses the data leak, but still says it didn't really have anything to do with it. It's now “working to get this data set taken down and will continue to aggressively go after malicious actors who misuse our tools wherever possible”. https://about.fb.com/...
@wolfiechristl Wolfie Christl on x
Collecting data by “upload[ing] a large set of phone numbers to see which ones matched Facebook users” is not simple “scraping”. I care more about FB intentionally misusing personal data than about security issues, but as usual this is just misinformation https://about.fb.com/...
@seanwrightsec Sean Wright on x
“is important to understand that malicious actors obtained this data not through hacking our systems but by scraping it from our platform prior to September 2019.” This is probably even worse than them breaching your system! 🤦‍♂️ https://about.fb.com/...
@privacymatters @privacymatters on x
“The @DPCIreland attempted over the weekend to establish the full facts and is continuing to do so. It received no proactive communication from Facebook.” Facebook “committed to .. protecting your information ” https://twitter.com/... https://twitter.com/...
@ashk4n Ashkan Soltani on x
In 2019 @UKZak wrote about a vulnerability in @Instagram's contact importer which @Facebook considered “low risk” and confirmed “the [Facebook Security] team were already aware of” (2/6) https://www.forbes.com/... https://twitter.com/...
@ashk4n Ashkan Soltani on x
The Canada @OPC also previously filed a complaint against @Facebook for a breach involving the “disclosure of contact information uploaded by Facebook users through the ‘Contact Importer’ process” — so @Facebook is has experience with this issue. (3/6) https://www.priv.gc.ca/... …
@ashk4n Ashkan Soltani on x
I mean, I guess this is further evidence that @Facebook should be regulated like a utility.... They've already become the de-facto ‘phone book’ provider regardless of whether users want to be listed or not.... ;) https://twitter.com/...
@ashk4n Ashkan Soltani on x
Facebook instead revealed which ‘public’ user profile information is associated to a given phone number — information that isn't public by default. For example, my name, facebook_id, and private phone number are all contained within the latest dump for all to see. (5/6) https://t…
@vmanancourt Vincent Manancourt on x
.@laurenscerulus and I were able to contact a European head of state and a top EU Commissioner *directly* using details in the Facebook leak. Imagine what sophisticated scammers could do. https://www.politico.eu/...
@laurenscerulus Laurens Cerulus on x
Among the victims of Facebook's data leak: EU privacy commissioner Didier Reynders Luxembourg's Prime Minister Xavier Bettel Several EU Commissioner cabinet members, EU diplomats and staff Cyber experts warn for risks to public figures. w/ @vmanancourt https://www.politico.eu/...
@privacymatters @privacymatters on x
👆 So perhaps now that the EU Justice Commissioner & Germany's chief federal privacy regulator & US politicians have been impacted, we'll see change happen. Perhaps we'll see the kid of regulatory scrutiny and enforcement needed. https://www.politico.eu/...
@christinayiotis Christina Ayiotis on x
“dataset of Belgian & Luxembourgish victims .. phone numbers of dozens of EU officials ⁦@EU_Commission⁩ cabinet members, EU diplomats & staff ⁦@politico⁩ verified the authenticity of several officials' details .. reaching ⁦@dreynders⁩ ..” https://www.politico.eu/...
@1br0wn @1br0wn on x
My God, if this lot can't get @DPCIreland to take its #GDPR enforcement responsibilities seriously (or otherwise get the @eu_commission to take infringement proceedings against the Irish government), I don't know who can 😑 https://twitter.com/...
@privacymatters @privacymatters on x
The EU Justice Commissioner & other EU officials & Germany's chief federal privacy regulator will be feeling much better to know it wasn't the fault of Facebook & that they should have been more careful & not trusted Facebook - dumb fucks eh Zuck? https://www.politico.eu/...

Chronicles