Facebook users' phone numbers and personal data were leaked to 533 million online users

Facebook 2021

Aaron Holmes two hours ago

 Facebook CEO Mark Zuckerberg

AP Photo / Andrew Harnik

The personal data of more than 500 million Facebook users was posted online in a low-level hacking forum.

The data includes phone numbers, full names, location, email address, and biographical information

Security researchers warn that the data can be used by hackers to impersonate people and commit fraud.

See more stories on the Insider business page.

A user on a low-level hacking forum posted the phone numbers and personal data of hundreds of millions of Facebook users for free online.

The exposed data includes the personal information of more than 533 million Facebook users from 106 countries, including over 32 million records on users in the United States, 11 million on users in the United Kingdom, and 6 million on users in India. It includes their phone numbers, Facebook IDs, full names, locations, dates of birth, resumes and - in some cases - email addresses.

Insider reviewed a sample of the leaked data and verified multiple records by matching the phone numbers of known Facebook users with the IDs included in the dataset. We also verified the logs by testing email addresses from the dataset in the Facebook password reset feature, which can be used to partially reveal a user's phone number.

The leaked data could provide valuable information to cybercriminals who use people's personal information to impersonate or trick them into handing over login credentials, according to Alon Gall, chief technology officer at cybercrime intelligence firm Hudson Rock, who first discovered the leaked data on Saturday.

"A database this large that contains private information like the phone numbers of many Facebook users will definitely lead to nasty actors leveraging the data to carry out social engineering attacks [or] hacking attempts," Gall told Insider.

Facebook didn't immediately respond to multiple requests for comment.

Gall first discovered the leaked data in January when a user on the same hacking forum announced an automated bot that could provide phone numbers to hundreds of millions of Facebook users for a price. Motherboard reported the existence of this bot at the time and checked the legitimacy of the data.

Now, the entire dataset is posted on the hacking forum for free, making it widely available to anyone with raw data skills.

This is not the first time that a large number of Facebook users' phone numbers have been found exposed online. One vulnerability exposed in 2019 allowed millions of phone numbers to be pulled from Facebook's servers in violation of its Terms of Service. Facebook said the vulnerability was corrected in August 2019.

Facebook previously pledged to crack down on collective data collection after Cambridge Analytica removed the data of 80 million users in violation of Facebook's terms of service 

Gal said that, from a security point of view, there isn't much Facebook can do to help users affected by the breach because their data is already open - but he added that Facebook can notify users so they stay vigilant.

face bk

What is phishing? Here's what you should know about default fraud and how to protect yourself from data theft

Phishing is a form of cybercrime where you receive an email from a fake sender pretending to be someone else.

Typically, the goal of phishing emails is to get you to give up personal or sensitive information.

 Schemes or fraudulent use of their personal data.

“Individuals who subscribe to a reputable company like Facebook trust them with their data and Facebook . is supposed to treat the data with extreme respect,  said Gal. Leaking users' personal information is a major breach of trust and should be dealt with accordingly.