Facebook data breach: what happened and what to do

What happened

Have I Been Pwned (HIBP) dates this Facebook data set to August 2019 and added it to its database on 4 April 2021, with 509,458,528 accounts. The data surfaced publicly in April 2021, when a large collection of Facebook user records was posted for free online. Press coverage at the time cited roughly 533 million records across more than 100 countries, including about 32 million in the US, 11 million in the UK and 6 million in India. HIBP's count is the number of accounts in the version it loaded.

Meta, Facebook's parent company, called the data old. A spokesperson said it matched previously known data related to a Contact Importer vulnerability that was fixed in late August 2019. Facebook said the data was scraped, meaning collected automatically from the platform, not hacked from its servers. The weakness made it possible to enter many phone numbers and, by running an algorithm, match each number to a specific user.

Facebook told NPR that it did not plan to notify users individually, saying it was not certain which users would need to be notified and that the information was publicly available and not something users could fix themselves.

What was exposed

HIBP lists dates of birth, email addresses, employers, genders, geographic locations, names, phone numbers and relationship statuses. Coverage at the time also mentioned Facebook IDs and profile bios. No passwords are in the data.

The central fields are the phone number and the name. Because the data was collected by matching phone numbers to profiles, the phone number is the key that links everything else. Many people had no idea their number was searchable in this way.

What it lets criminals do

A phone number tied to a name, a city, an employer and a date of birth is a strong starting point for several kinds of fraud. Text-message scams can address you by name and mention your employer. Criminals who want to take over your phone number through a SIM swap (persuading a carrier to move your number to their SIM) can use your name and date of birth to answer security questions. Once they have your number, they can intercept text-message login codes.

Data like this also helps build profiles. Combined with other leaks, a name, number and date of birth can fill gaps in someone's record on people-search sites. The data has been public since 2021 and copies of it still circulate, so the exposure doesn't expire.

Facebook's response

Meta fixed the contact importer weakness in 2019, before the leak was posted. It did not send notices to users in 2021. The only reliable way to know if you are in the data set is to check your email address or phone number against a breach database.

What you can limit now

You can't take your details back out of a copy that is already circulating. You can reduce what the platform shows and make a stolen phone number less useful: use an authenticator app instead of text codes, add a PIN or port-out lock with your carrier, and review who can find you by phone number in your Facebook privacy settings.