The data of more than 500 million Facebook users was compromised. How can we protect ourselves?

In April 2021, the internet was buzzing: the data of more than 533 million Facebook users had been made public on a hacking forum, as The Record reported.

The information posted online included the following: Facebook ID, profile name, email address, location, gender, workplace information and other data users had entered in their profiles. Much of it was public anyway, on users’ profiles on the social network.

The database, however, also contained users’ phone numbers, information that most of the time isn’t public.

The hackers published the data in 106 separate archives, grouped by country. The archives couldn’t be downloaded by just anyone, only by those who bought credits on the forum.

Facebook announced at the time that the hackers had obtained the information in an attack in 2019 and that the vulnerability had been fixed.

Data of users in Romania didn’t appear in the archives. The exposed accounts belonged to users in the following countries:

Afghanistan, Africa, Angola, Albania, Algeria, Argentina, Austria, Australia, Azerbaijan, Bahrain, Bangladesh, Belgium, Bolivia, Botswana, Brazil, Brunei, Bulgaria, Burkina Faso, Burundi, Cambodia, Cameroon, Canada, Chile, China, Colombia, Costa Rica, Croatia, Cyprus, Czech Republic, Denmark, Djibouti, Ecuador, Egypt, El Salvador, Estonia, Ethiopia, Fiji, Finland, France, Georgia, Germany, Ghana, Greece, Guatemala, Haiti, Honduras, Hong Kong, Hungary, Iceland, India, Indonesia, Iran, Iraq, Ireland, Israel, Italy, Jamaica, Japan, Jordan, Kazakhstan, Kuwait, Lebanon, Libya, Lithuania, Luxembourg, Macao, Malaysia, Maldives, Malta, Mauritius, Mexico, Moldova, Morocco, Namibia, Netherlands, Nigeria, Norway, Oman, Palestine, Panama, Peru, Philippines, Poland, Portugal, Puerto Rico, Qatar, Russia, Saudi Arabia, Serbia, Singapore, Slovenia, South Korea, Spain, Sudan, Sweden, Switzerland, Syria, Taiwan, Tunisia, Turkey, Turkmenistan, United Arab Emirates, United Kingdom, Uruguay, USA, Yemen.

IT security for companies: tell me more →

What happened after the data leak?

The data didn’t come from a classic attack on servers, but from automated collection (scraping): the attackers had abused a contact import feature to match phone numbers with profiles.

In November 2022, the Irish data protection authority (the Data Protection Commission) fined Meta, the company that owns Facebook, €265 million for failing to protect users’ data adequately, as the GDPR requires. Meta said at the time that it had changed its systems to stop this kind of collection.

Also in 2021, the free service Have I Been Pwned added this data and made it searchable by phone number. On the same site, you can check at any time whether your email address appears in known data leaks.

What should we learn from this whole experience?

• Don’t post sensitive data on your Facebook profile.
• Don’t use your personal email address for Facebook; create a separate address just for social networks and use it on every platform.
• If you have two phone numbers, don’t use your main number for Facebook.
• Turn on two-step verification with an authenticator app or a security key, not by text message. A phone number that has become public helps attackers try to take it over (SIM swap).
• In your privacy settings, limit who can find you by your phone number or email address.
• Be wary of text messages, calls and messages that appear to come from your bank, a courier or even Facebook: leaked data is used for personalized scams. See how to check whether an email is spam and how to protect yourself from phishing.
• At work, employees shouldn’t use their work address for social networks, and a short training session on phishing helps them recognize fake messages.

This kind of information will keep surfacing on the internet, whatever social platforms you use.

RezolvIT is an ISO/IEC 27001-certified managed IT services company that places great value on following security standards and helps the companies it works with protect their accounts and data. See IT security.