Facebook\u2019s lead data protection regulator in the European Union is seeking answers from the tech giant over a major data breach reported over the weekend.<\/p>\n
The breach was reported by Business Insider<\/a> on Saturday, which said personal data (including email addresses and mobile phone numbers) of more than 500 million Facebook accounts had been posted to a low-level hacking forum \u2014 making the personal information on hundreds of millions of Facebook users\u2019 accounts freely available.<\/p>\n \u201cThe exposed data includes the personal information of over 533M Facebook users from 106 countries, including over 32M records on users in the US, 11M on users in the UK, and 6M on users in India,\u201d Business Insider said, noting that the dump includes phone numbers, Facebook IDs, full names, locations, birthdates, bios and some email addresses.<\/p>\n Facebook responded to the report of the data dump by saying it related to a vulnerability in its platform it had \u201cfound and fixed\u201d in August 2019 \u2014 dubbing the info \u201cold data\u201d which it also claimed had been reported in 2019. However as security experts were quick to point out<\/a>, most people don\u2019t change their mobile phone number often \u2014 so Facebook\u2019s trigger reaction to downplay the breach looks like an ill-thought-through attempt to deflect blame.<\/p>\n How to respond to a data breach<\/a><\/p>\n<\/blockquote>\n\n It\u2019s also not clear whether all the data is all \u201cold\u201d, as Facebook\u2019s initial response suggests.<\/p>\n This is old data that was previously reported on in 2019. We found and fixed this issue in August 2019. https:\/\/t.co\/mPCttLkjzE<\/a><\/p>\n \u2014 Liz Bourgeois (@Liz_Shepherd) April 3, 2021<\/a><\/p>\n<\/blockquote>\n\n There\u2019s plenty of reasons for Facebook to try to downplay yet another data scandal. Not least because, under European Union data protection rules, there are stiff penalties for companies that fail to promptly report significant breaches to relevant authorities. And indeed for breaches themselves \u2014 as the bloc\u2019s General Data Protection Regulation (GDPR) bakes in an expectation of security by design and default.<\/p>\n By pushing the claim that the leaked data is \u201cold\u201d Facebook may be hoping to peddle the idea that it predates the GDPR coming into application (in May 2018).<\/p>\n However, the Irish Data Protection Commission (DPC), Facebook\u2019s lead data supervisor in the EU, told TechCrunch that it\u2019s not abundantly clear whether that\u2019s the case at this point.<\/p>\n \u201cThe newly published dataset seems to comprise the original 2018 (pre-GDPR) dataset and combined with additional records, which may be from a later period,\u201d the DPC\u2019s deputy commissioner, Graham Doyle said in a statement.<\/p>\n \u201cA significant number of the users are EU users. Much of the data appears to been data scraped some time ago from Facebook public profiles,\u201d he also said.<\/p>\n \u201cPrevious datasets were published in 2019 and 2018 relating to a large-scale scraping of the Facebook website which at the time Facebook advised occurred between June 2017 and April 2018 when Facebook closed off a vulnerability in its phone lookup functionality. Because the scraping took place prior to GDPR, Facebook chose not to notify this as a personal data breach under GDPR.\u201d<\/p>\n Doyle said the regulator sought to establish \u201cthe full facts\u201d about the breach from Facebook over the weekend and is \u201ccontinuing to do so\u201d \u2014 making it clear that there\u2019s an ongoing lack of clarity on the issue, despite the breach itself being claimed as \u201cold\u201d by Facebook.<\/p>\n The DPC also made it clear that it did not receive any proactive communication from Facebook on the issue \u2014 despite the GDPR putting the onus on companies to proactively inform regulators about significant data protection issues. Rather, the regulator had to approach Facebook \u2014 using a number of channels to try to obtain answers from the tech giant.<\/p>\n Through this approach the DPC said it learnt Facebook believes the information was scraped prior to the changes it made to its platform in 2018 and 2019 in light of vulnerabilities identified in the wake of the Cambridge Analytica data misuse scandal.<\/p>\n A huge database of Facebook phone numbers was found unprotected online back in September 2019<\/a>.<\/p>\n Facebook had also earlier admitted to a vulnerability with a search tool it offered \u2014 revealing in April 2018<\/a> that somewhere between 1 billion and 2 billion users had had their public Facebook information scraped via a feature which allowed people to look up users by inputting a phone number or email \u2014 which is one potential source for the cache of personal data.<\/p>\n Last year Facebook also filed a lawsuit<\/a> against two companies it accused of engaging in an international data scraping operation.<\/p>\n But the fallout from its poor security design choices continue to dog Facebook years after its \u2018fix\u2019.<\/p>\n More importantly, the fallout from the massive personal data spill continues to affect Facebook users whose information is now being openly offered for download on the internet \u2014 opening them up to the risk of spam and phishing attacks and other forms of social engineering (such as for attempted identity theft).<\/p>\n There are still more questions than there are answers about how this \u201cold\u201d cache of Facebook data came to be published online for free on a hacker forum.<\/p>\n The DPC said it was told by Facebook that \u201cthe data at issue appears to have been collated by third parties and potentially stems from multiple sources\u201d.<\/p>\n The company also claimed the matter \u201crequires extensive investigation to establish its provenance with a level of confidence sufficient to provide your Office and our users with additional information\u201d \u2014 which is a long way of suggesting that Facebook has no idea either.<\/p>\n \u201cFacebook assures the DPC it is giving highest priority to providing firm answers to the DPC,\u201d Doyle also said. \u201cA percentage of the records released on the hacker website contain phone numbers and email address of users.<\/p>\n \u201cRisks arise for users who may be spammed for marketing purposes but equally users need to be vigilant in relation to any services they use that require authentication using a person\u2019s phone number or email address in case third parties are attempting to gain access.\u201d<\/p>\n \u201cThe DPC will communicate further facts as it receives information from Facebook,\u201d he added.<\/p>\n At the time of writing Facebook had not responded to a request for comment about the breach.<\/p>\n Facebook users who are concerned whether their information is in the dump can run a search<\/a> for their phone number or email address via the data breach advice site, haveibeenpwned<\/a>.<\/p>\n According to haveibeenpwned\u2019s Troy Hunt, this latest Facebook data dump contains far more mobile phone numbers than email addresses.<\/p>\n He writes that he was sent the data a few weeks ago \u2014 initially getting 370 million records and later \u201cthe larger corpus which is now in very\u00a0<\/em>broad circulation\u201d.<\/p>\n \u201cA lot of it is the same, but a lot of it is also different,\u201d Hunt also notes, adding: \u201cThere is not one clear source of this data.\u201d<\/p>\n Update:<\/strong> Facebook has now published a blog post<\/a> with some additional details about the breach in which it writes that it believes the data in question was scraped from people\u2019s Facebook profiles by \u201cmalicious actors\u201d using a contact importer feature prior to September 2019 \u2014 before it made changes to the tool intended to prevent abuse by blocking the ability to upload a large set of phone numbers to find ones that matched profiles.<\/p>\n \u201cThrough the previous functionality, [users of Facebook\u2019s contact importer tool] were able to query a set of user profiles and obtain a limited set of information about those users included in their public profiles,\u201d Facebook writes, adding that the information obtained did not include financial information, health information or passwords.<\/p>\n However it does not specify what data could have been obtained by these malicious actors repurposing its tools. Or whether it has identified and sought to prosecute the actors in question.<\/p>\n Instead its PR segues into stating that such action is against its terms<\/a> \u2014 as well as claiming it is \u201cworking to get this data set taken down\u201d. It also says it will \u201ccontinue to aggressively go after malicious actors who misuse our tools wherever possible\u201d \u2014 again without offering any examples of instances where it has successfully identified and definitively barred an abuser from its service.<\/p>\n (Where, for instance, is the final report of an internal app audit that Facebook said it would carry out after the Cambridge Analytica scandal back in 2018? The UK\u2019s data protection regulator said recently<\/a> that a legal deal it has with Facebook prevents it from discussing the app audit in public. So Facebook certainly appears to have an aggressive approach when it comes to avoiding transparency on how it tackles misuse of its tools\u2026 )<\/p>\n \u201cWhile we can\u2019t always prevent data sets like these from recirculating or new ones from appearing, we have a dedicated team focused on this work,\u201d Facebook adds in the PR, offering no guarantees to users that their data is safe with its service.<\/p>\n Instead it recommends users check the privacy settings it offers for accounts, including those which provide some controls over how others can find you on its service \u2014 a line which seeks to deflect from the latest Facebook data breach revelation via some suggestive blame-shifting; i.e. by implying that responsibility for data security is in the hands of Facebook users, rather than Facebook itself.<\/p>\n Of course that\u2019s not the case. Not least because Facebook users are only offered partial controls over their data by Facebook, and entirely of Facebook\u2019s design and devising (including setting privacy-hostile defaults<\/a>).<\/p>\n Moreover, in Europe at least, the company has a legal responsibility to bake security into the design of its products. Failure to offer an adequate level of protection for personal data can attract major regulatory sanction \u2014 although the company continues to benefit from a GDPR enforcement bottleneck<\/a>.<\/p>\n Facebook\u2019s PR also suggests users enable two-factor authentication to improve account security. <\/span><\/p>\n That\u2019s certainly a good idea but o<\/span>n the 2FA front it\u2019s worth noting that Facebook does now offer support for security key and third-party authentication apps for 2FA<\/a> \u2014 meaning you can add this extra layer of security without risking giving Facebook your mobile number. And since the service has demonstrably leaked users\u2019 phone numbers at vast scale \u2014 while the business has also admitted to using 2FA digits for ad targeting<\/a> \u2014 you really shouldn\u2019t trust Facebook with your phone number.<\/p>\n Update 2:<\/strong> In additional background remarks Facebook said it will not be commenting on how it communicates with regulators.<\/p>\n It also said it has no plans to notify users individually about the breach \u2014 further specifying that owing to how the data was obtained (scraping) it cannot be entirely sure who would need to be notified.\u00a0 \u00a0<\/span><\/p>\n A huge database of Facebook users\u2019 phone numbers found online<\/a><\/p>\n<\/blockquote>\n\n Facebook sues two companies engaged in data scraping operations<\/a><\/p>\n<\/blockquote>\n\n\n
\n
\n
\n
\n