On Saturday, a user in a low-level hacking forum published the phone numbers and personal data of hundreds of millions of Facebook users for free online.
The data exposed includes personal information of over 533 million Facebook users from 106 countries, including over 32 million records on users in the US, 11 million on users in the UK, and 6 million on users in India. It includes their phone numbers, Facebook IDs, full names, locations, birthdates, bios, and — in some cases — email addresses.
The outlet reviewed a sample of the leaked data and verified a series of records “by matching known Facebook users’ phone numbers with the IDs listed in the data set.” Insider also confirmed the data’s accuracy by typing in exposed email addresses into Facebook’s password reset feature, which shows part of a user’s phone number.
Insider reviewed a sample of the leaked data and verified several records by matching known Facebook users’ phone numbers with the IDs listed in the data set. We also verified records by testing email addresses from the data set in Facebook’s password reset feature, which can be used to partially reveal a user’s phone number.
According to Insider the data was scraped due to a vulnerability that the company patched in 2019, said by Facebook spokesperson.
While a couple of years old, the leaked data could provide valuable information to cybercriminals who use people’s personal information to impersonate them or scam them into handing over login credentials, according to Alon Gal, CTO of cybercrime intelligence firm Hudson Rock, who first discovered the entire trough of leaked data online on Saturday.
“A database of that size containing the private information such as phone numbers of a lot of Facebook’s users would certainly lead to bad actors taking advantage of the data to perform social engineering attacks [or] hacking attempts,” Gal told Insider.
Gal first discovered the leaked data in January when a user in the same hacking forum advertised an automated bot that could provide phone numbers for hundreds of millions of Facebook users in exchange for a price. Motherboard reported on that bot’s existence at the time and verified that the data was legitimate.
Personal information from users around the world is being offered for a few euros’ worth of digital credit on a well-known site for digital hackers and Gal said he had verified the authenticity of the data.
Other journalists say they have also been able to match known phone numbers to the details in the data dump.
An attempt by Reuters to reach the leaker over the messaging service Telegram was not immediately successful.
The availability of the data set was first reported by Business Insider. According to that publication, it has information from 106 countries including phone numbers, Facebook IDs, full names, locations, birthdates, and email addresses.
It is claimed that the server listed some accounts and their geographical locations, with a user’s unique Facebook ID stored alongside their phone number, as well as their gender.
The haul meant people were exposed to potential fraud attempts including spam calls and SIM-swapping attacks where criminals try and get hold of more personal details by deceiving carrier firms.
The server was not password protected, meaning anyone could access the databases.
Watch it here: TRT World/Youtube