Facebook has not notified the more-than 530m users whose details were exposed on a hacker forum in 2019 and has no plans to do so, according to company representatives.
Business Insider reported last week that phone numbers and other details from Facebook user profiles were available in a public database. The social media company acknowledged in a blogpost on Tuesday that “malicious actors” had obtained the data prior to September 2019 by “scraping” profiles using a vulnerability in the platform’s tool for syncing contacts. Facebook has said it plugged the hole after identifying the problem at the time.
But a Facebook spokesperson said on Wednesday that the company would not be notifying users affected by the hack and that it was not confident it had full visibility on which users would need to be alerted. He said the company also took into account that users could not fix the issue and that the hacked data was publicly available.
The scraped information did not include financial information, health information or passwords, Facebook said. However, the collated data could provide valuable information for hacks or other abuses, according to experts.
Much of the stolen data – including phone numbers and birth dates – is not often changed or in some cases impossible to change. That means those details are still likely attached to active users, said Ivan Righi, a cyber threat intelligence analyst at San Francisco-based digital security firm Digital Shadows.
“Cybercriminals can use information such as phone numbers, emails and full names to launch targeted social engineering attacks,” he said. “As most users are still working from home due to the pandemic, these attacks could be effective if personalized to target victims, like sending text messages impersonating companies or banks to users.”
Facebook, which has long been under scrutiny over how it handles user privacy, in 2019 reached a landmark settlement with the US Federal Trade Commission over its investigation into allegations the company misused user data. That settlement requires Facebook to report details about unauthorized access to data on 500 or more users within 30 days of confirming an incident.
Ireland’s Data Protection Commission, the European Union’s lead regulator for Facebook, said on Tuesday it had contacted the company about the data leak. It said it received “no proactive communication from Facebook” but was now in contact.
The Facebook spokesperson declined to comment on the company’s conversations with regulators but said it was in contact to answer their questions.
The breach revealed last week renews security and privacy concerns stemming from Facebook’s dominance in the tech industry, as the social media giant frequently refuses to “open its walled garden or permit accountability research into its policies”, said Cory Doctorow of digital rights group the Electronic Frontier Foundation.
