Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.



An exposed server with more than 419 million records from Facebook users has been discovered online, reports TechCrunch.

The server was not protected with a password and was accessible to anyone. It featured 133 million records from U.S.-based Facebook users, 18 million records from users in the UK, and 50 million records on users in Vietnam.

facebooksecurity.jpg

The records contained each person's unique Facebook ID along with the phone number listed on the account. Facebook IDs are unique numbers that can be associated with an account to discover a person's username.

Facebook restricted access to phone numbers more than a year ago, so the database that was found is older than that. A Facebook spokesperson said that the data had been scraped prior to when Facebook cut off access to phone numbers, calling the dataset "old."TechCrunch was able to verify multiple records in the database by matching a known Facebook user's phone number against a listed Facebook ID. Other records were verified by matching phone numbers with Facebook's password reset feature, which can be used to partially reveal a phone number linked to an account. Records primarily had phone numbers, but in some cases, also had usernames, genders, and country location.

facebookdatabaseleak.jpg

Image via TechCrunch
Phone number security has become increasingly important over the course of the last few years due to SIM-hacking, which involves calling a phone carrier and asking for a SIM transfer for a specific number, thereby giving access to anything linked to that phone number, such as two-factor verification, password reset info, and more.

SIM-hacking requires little more than a phone number and social engineering skills, and it has been devastating for people who have been impacted. Leaked phone numbers also expose Facebook users to spam calls, which have also become more and more prevalent over the last several years.

The database was originally found by security researcher Sanyam Jain, who said that he was able to locate phone numbers associated with several celebrities. It's not clear who owned the database nor where it originated from, but it was taken offline after TechCrunch contacted the web host. There is no word on why the data was scraped from Facebook or what it was used for.

Article Link: Hundreds of Millions of Phone Numbers From Facebook Accounts Leaked Online
We need a law that stipulation each user gets $1000.00 plus damages if they occur. Then this crap might stop.
 
Don't put private info online and it won't be leaked by Apple, Facebook, etc.
 
God almighty. Not again!

FB is becoming the book of shieeet. Luckily I never use(d) it.
 
Just came here for the self-righteous “I don’t use Facebook”, “people who use Facebook are stupid” etc posts.
Well, I used to be on FB. Over a year ago I dropped it. It feels great. What a waste of time that thing is. Bunch of people faking their best side of life. Trust me, if you quit it you won't regret it.
 
Why are people still using Facebook. It's already been proven many times that they don't care about your data
 
This is why you don’t give your phone number to Facebook. In fact, you only give the barest of information.
 



An exposed server with more than 419 million records from Facebook users has been discovered online, reports TechCrunch.

The server was not protected with a password and was accessible to anyone. It featured 133 million records from U.S.-based Facebook users, 18 million records from users in the UK, and 50 million records on users in Vietnam.

facebooksecurity.jpg

The records contained each person's unique Facebook ID along with the phone number listed on the account. Facebook IDs are unique numbers that can be associated with an account to discover a person's username.

Facebook restricted access to phone numbers more than a year ago, so the database that was found is older than that. A Facebook spokesperson said that the data had been scraped prior to when Facebook cut off access to phone numbers, calling the dataset "old."TechCrunch was able to verify multiple records in the database by matching a known Facebook user's phone number against a listed Facebook ID. Other records were verified by matching phone numbers with Facebook's password reset feature, which can be used to partially reveal a phone number linked to an account. Records primarily had phone numbers, but in some cases, also had usernames, genders, and country location.

facebookdatabaseleak.jpg

Image via TechCrunch
Phone number security has become increasingly important over the course of the last few years due to SIM-hacking, which involves calling a phone carrier and asking for a SIM transfer for a specific number, thereby giving access to anything linked to that phone number, such as two-factor verification, password reset info, and more.

SIM-hacking requires little more than a phone number and social engineering skills, and it has been devastating for people who have been impacted. Leaked phone numbers also expose Facebook users to spam calls, which have also become more and more prevalent over the last several years.

The database was originally found by security researcher Sanyam Jain, who said that he was able to locate phone numbers associated with several celebrities. It's not clear who owned the database nor where it originated from, but it was taken offline after TechCrunch contacted the web host. There is no word on why the data was scraped from Facebook or what it was used for.

Article Link: Hundreds of Millions of Phone Numbers From Facebook Accounts Leaked Online

Seems like JSON files to me...
 
Doesn’t Facebook create a shadow profile for phone numbers unassigned to an account?
IIRC there was something about giving the Facebook app permission to scan the address book on your smartphone and they already have your number if that user allowed it.
Since we’re on the subject of people getting more and more naive - Facebook probably already has your name and number at the very least if someone gave it permission to scan their contacts.
 
Facebook's wanton disregard for its users' privacy is appalling. I deleted my Facebook and Instagram accounts last year and am much happier and feel much more secure for it.

Was it indeed deleted or just hidden? A related issue has to do with which database your data was deleted from. I suspect FB may delete your information from the working database but it likely lives and could be accessible in backups. Since this was an older database, how many "deleted" accounts were still compromised.
 
Doesn't surprise me one bit. I suspect all our online data is accessible by those who want it.

No, this is a seriously amateur mistake! This is a MongoDB database and does not need to be "online" for it to be available to Facebook's systems. It can live on an internal-only access point (no public IP address) so that it's not accessible from the outside world. The fact that it was accessible is a serious, serious foopah on their part! Bad developers!
 
  • Like
Reactions: stu.h
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.