Personal data from 533 million Facebook accounts leaked online for free, according to security researcher Alon Gal. Insider He said he checked several of the leaked records.
“The data exposed includes personal information from more than 533 million Facebook users from 106 countries, including more than 32 million user registrations in the US, 11 million users in the UK and 6 million users in India,” according with Insider. “It includes your phone numbers, Facebook IDs, full names, locations, dates of birth, biographies and – in some cases – email addresses.”
If that number of 533 million may sound familiar to you, it is because that information is apparently from the same data set that people could pay for parts of using a Telegram bot, which Motherboard reported in January. Now, however, it seems that those who want to get their hands on the dice won’t have to pay anything.
Details include:
Phone number, Facebook ID, full name, location, previous location, date of birth, (sometimes) email address, account creation date, relationship status, biography.
Evildoers will certainly use the information for social engineering, scams, hacking and marketing.
– Alon Gal (Under the Breach) (@UnderTheBreach) April 3, 2021
Facebook said Insider that this data was copied due to a vulnerability that was fixed in 2019. The company gave a similar response to Motherboard in January. “These are old data that were reported earlier in 2019,” said Facebook BleepingComputer. “We found and fixed this problem in August 2019.” Facebook did not respond to a request for comment from The Verge.
Troy Hunt, the creator of the Have I Been Pwned database, said on saturday that “I have not yet seen anything to suggest that this violation is not legitimate”. In the data, he found only about 2.5 million unique email addresses (which is still a lot!), But apparently “the biggest impact here is the phone numbers”. Here’s what that might mean, in the words of Hunt:
But for spam based only on the phone number, it’s gold. Not just SMS, there are many services that only require a phone number today and there are now hundreds of millions of them conveniently categorized by country with direct mail fields like name and gender.
– Troy Hunt (@troyhunt) April 3, 2021
If you can, I strongly recommend that you take a few minutes to read Hunt’s full Twitter topic about the breach.
Hunt has already loaded the leaked email addresses in Have I Been Pwned, which means that you can check whether yours has been included as part of the data set. He is still considering whether or not to make the leaked phone numbers available through the service.
FB phone numbers must be searchable at @Im sorry? I am thinking of the pros and cons in terms of the value it adds to the people affected in relation to the risk presented if it is used to help resolve numbers for identities (you would still need the source data to do this).
– Troy Hunt (@troyhunt) April 4, 2021