Originally published 2021-04-06.
In early April 2021 a dataset covering about 533 million Facebook users in 106 countries was posted free of charge on a hacker forum. It held phone numbers, Facebook IDs, full names, locations, birthdates and, for a smaller share of accounts, email addresses. Facebook said the information had been scraped through a feature it fixed in 2019, but because phone numbers and birthdays rarely change, the leak remained useful to scammers long after it was collected.
Here is what was exposed, how it happened, what regulators did about it and what you can still do to protect yourself.
What was in the dataset
The records varied by person, but typical fields included:
- Mobile phone number linked to the account
- Facebook user ID and full name
- Gender, location and hometown
- Relationship status, workplace and birthdate where users had listed them
- An email address in a small minority of records, about 2.5 million in total
Reports at the time put the US total at more than 30 million accounts, with around 11 million in the UK and about 6 million in India. No passwords or financial details were included, which is why Facebook described the event as scraping rather than a hack of its systems. To the people listed, that distinction mattered less than the fact that their private phone numbers were now attached to their names in a public file.
How the data was collected
The information was gathered by automated "scraping" between roughly May 2018 and September 2019. Attackers abused Facebook's contact-import and search tools, which were designed to help people find friends by phone number. By feeding in long lists of possible numbers and recording which accounts matched, they could link millions of numbers to profiles, then copy whatever profile details were visible.
Facebook said it closed this route in 2019. A version of the data had already circulated in criminal markets during 2020, when a bot on Telegram reportedly offered phone-number lookups for a fee. Cybercrime researcher Alon Gal of the Israeli firm Hudson Rock flagged that sale in January 2021, and then warned in April when the entire set was released for free.
In early 2020 a vulnerability that enabled seeing the phone number linked to every Facebook account was exploited, creating a database containing the information 533m users across all countries.
— Alon Gal (Under the Breach) (@UnderTheBreach) January 14, 2021
It was severely under-reported and today the database became much more worrisome 1/2 pic.twitter.com/ryQ5HuF1Cm
(This post is no longer available on X.)
Gal argued at the time that a database of that size would almost certainly be used for social-engineering attacks and hacking attempts, and that users had trusted the company with their information.
Why "old" data can still hurt
A natural question was whether information from 2019 still mattered in 2021. It did, for a simple reason: most people keep the same phone number and birthday for many years. Those two details are often used to verify identity with banks, mobile carriers and online services.
With a name, number and birthdate, a criminal can:
- Send text messages or calls that sound personal and trustworthy ("smishing")
- Attempt a SIM-swap, persuading a phone company to move your number to a new SIM card so that login codes go to the attacker
- Reset passwords on services that rely on text-message codes
- Build a fuller profile by combining this data with other leaks
A message that already knows your name and birthday can feel genuine. Familiar details are not proof that the sender is legitimate.
The €265 million fine
Ireland's Data Protection Commission, Facebook's lead privacy regulator in the European Union because its European headquarters is in Dublin, opened an inquiry after the release. On 28 November 2022 it fined Meta, Facebook's parent company, €265 million and ordered corrective measures. The regulator found that the company had broken the GDPR's rule requiring "data protection by design and by default", because its friend-finding tools allowed mass scraping.
Meta said it had cooperated, had changed its systems and that unauthorised scraping was against its rules. It was one of several large Irish penalties against the group, including €225 million against WhatsApp in 2021 and €405 million against Instagram in 2022.
A longer history of privacy controversies
The scraping incident landed on a company that had faced years of criticism over user data. The best known case is Cambridge Analytica. A personality-quiz app built by researcher Aleksandr Kogan in 2013 was installed by about 270,000 people, but because of Facebook's platform rules at the time it also collected data on their friends, up to 87 million profiles in total. Cambridge Analytica later used that data for political targeting, including work for Donald Trump's 2016 US presidential campaign.
It is often said that the firm also swung the 2016 Brexit referendum. The UK Information Commissioner's Office investigated and concluded that Cambridge Analytica was not involved in the referendum "beyond some initial enquiries". The scandal still led to a US$5 billion Federal Trade Commission penalty in 2019 and a £500,000 fine from the UK regulator.
Facebook has also been criticised for its handling of misinformation and hate speech, and for its slow response to Russian influence operations that used the platform around the 2016 US election, which US investigators later documented in detail.
How to check and protect yourself
You cannot remove information from a dataset that has already spread, but you can make it far less useful to a criminal:
- Check exposure. The free service Have I Been Pwned, run by security researcher Troy Hunt, loaded the email addresses from this leak and shortly afterwards also allowed searches by phone number.
- Use an authenticator app or security key instead of text messages for two-factor login where possible.
- Add a PIN or port-out lock with your mobile carrier to make SIM-swaps harder.
- Review Facebook's privacy settings. Under "How people find and contact you", limit who can look you up by phone number or email.
- Treat unexpected requests with caution. If a message asks for money, a login code or personal details, contact the person or company through a route you already trust.
The 2021 release was not a new breach each time it resurfaced in the news, and there was no need to panic. It was, though, a clear reminder that personal details you share online can outlive the services and settings that exposed them.
Sources: AP via ClickOnDetroit: Irish watchdog fines Meta 265M euros in latest privacy case (28 November 2022); ABC7: How to tell if your Facebook account was one of the half billion breached (April 2021); Wikipedia: Facebook–Cambridge Analytica data scandal; tweet by Alon Gal (shown above).
COMMENTS