Facebook Marketplace facebook.com Facebook Marketplace data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In February 2024, about 200,000 Facebook Marketplace records, allegedly from a Meta contractor, were posted to a hacking forum. Have I Been Pwned lists 77,267 unique emails, with names, phone numbers, Facebook profile IDs and locations.
View all 13,118 breaches- Breach date
- Oct 2023
- Affected
- 77,267
- Data exposed
- Email addresses, Geographic locations, Names, Passwords, Phone numbers, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In February 2024, 200,000 Facebook Marketplace records allegedly obtained from a Meta contractor in October 2023 were posted to a hacking forum. Have I Been Pwned (HIBP) counts 77,267 unique email addresses in the data and added it on 22 February 2024. The contractor origin is the poster's claim, not a confirmed finding. BleepingComputer reported on the leak, and said random records it examined matched real details.
Sources checked: haveibeenpwned.com, bleepingcomputer.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
Email addresses, names, phone numbers, Facebook profile IDs and geographic locations. The data also contained bcrypt password hashes, but HIBP says there is no indication these belong to the matching Facebook accounts.
What it means for you
A name, phone number and location are what scammers use to build believable fake buyer or seller messages and scam texts. Because the hashes may not be your Facebook password, the main task is staying alert to messages that mention Marketplace, not rushing to panic about your Facebook login.
The company's response
The leak's origin rests on the forum poster's claim. HIBP's entry and the BleepingComputer report are the public record.
What to do if you were in it
- 1
Expect scam messages
With your name, phone number and location out there, scammers can send convincing phishing emails and texts. Don't click links in unexpected messages; go to the company's site yourself.
- 2
Be careful with Marketplace messages
Don't click links or move to another app to complete a sale or payment because a stranger asks. Keep the conversation and payment on the platform.
- 3
Change the password and anywhere you reused it
If you used your Facebook password on any other account, change it there now, and use a different password for each account. A password manager makes that easy. If you can't remember, changing it is a cheap precaution.
- 4
Turn on two-factor login
Use an authenticator app or passkey on your important accounts, starting with email. It blocks most takeovers even when a password has leaked. The FTC lists this among its post-breach steps.
- 5
Check where else your details have leaked
To see which other breaches include your email or phone, run a free Serus scan.
Frequently asked
Was I affected by the Facebook Marketplace breach?
Search your email on Have I Been Pwned. If FacebookMarketplace shows up, your email was among the 77,267 listed.
What was exposed?
Email addresses, names, phone numbers, Facebook profile IDs, locations and bcrypt hashes that HIBP says may not belong to Facebook accounts.
Should I change my Facebook password?
HIBP found no sign the hashes belong to Facebook accounts, but changing a reused password is still sensible.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
