Facebook announced Wednesday that hundreds of millions of users’ phone numbers are exposed in an open online database. This is the latest example of Facebook’s past privacy lapses coming back to haunt its users. Recall that in April this year, Facebook announced that it had mistakenly stored millions of Instagram passwords in plain text
In the latest incident, more than 419 million Facebook IDs and phone numbers were stored in an online server that was not password protected, TechCrunch reported. This includes about 133m records for users in the US, 18m records for users in the UK and 50m records for users in Vietnam.
The database was taken offline after TechCrunch contacted the web host.
Facebook confirmed the mess on Wednesday and said it was investigating when and by whom the database was compiled.
A spokeswoman for Facebook claimed that the actual number of users whose information was exposed was only about 210m, because the 419m records contained duplicates, according to her.
The records were likely amassed using a tool that Facebook disabled in April 2018 in the aftermath of the Cambridge Analytica controversy. The revelations showed how Facebook’s lax approach to privacy had allowed a political consultancy to obtain personal information from tens of millions of profiles, the Guardian reported.
Until then, Facebook allowed anyone to search for users by their phone number, a seemingly benign tool for finding an individual with a common name that was also readily hijacked by data scrapers.
“Malicious actors have also abused these features to scrape public profile information by submitting phone numbers or email addresses they already have through search,” chief technology officer Mike Schroepfer wrote at the time.
“Given the scale and sophistication of the activity we’ve seen, we believe most people on Facebook could have had their public profile scraped in this way.”
But Facebook said that the exposed data was “old” and would have been scraped prior to the April 2018 policy change.
“This dataset is old and appears to have information obtained before we made changes last year to remove people’s ability to find others using their phone numbers,” a spokeswoman said in a statement. “The dataset has been taken down and we have seen no evidence that Facebook accounts were compromised.”
The spokeswoman did not respond to questions about whether Facebook would inform users whose information was exposed or offer any mitigation to those affected, saying only that the company was still investigating.
Facebook’s characterization of the data as “old” notwithstanding, phone numbers are an increasingly important key to people’s identities – and a potential vulnerability. While not as sensitive as a social security number, they are important identifiers that can be used to easily obtain significant amounts of personal information about an individual and their family from online data brokers, as the New York Times reported in August.
Skilled attackers can often leverage a mobile phone number and information gained through data brokers or social media sites (such as home address, previous addresses, family members, etc) to persuade mobile phone carriers to transfer a target’s phone number to a different phone.