People search Facebook data breach timeline because the brand sits on billions of accounts, credentials, and cloud workloads. BreachHistory indexes 24 Facebook-linked incidents, with headline counts up to 26B+ in catalog rows. This page maps every attested event through 2026 with internal links to canonical records.
Why Facebook breach history matters
Facebook operates in Technology (United States). Across indexed rows, recurring themes include credential theft and social engineering, cloud and database misconfiguration, third-party and supply-chain exposure, zero-day exploitation and malware, unverified actor or scraping claims. Understanding the chronological pattern helps security teams, customers, and regulators separate confirmed disclosures from forum marketing.
Full timeline through 2026
2025 — 17M Facebook logins
Cataloged incident. Subset of 183M record leak focused on social media. Contained 17 million valid Facebook/Meta login combinations harvested from active infections in latter half of 2025. Exposed categories include Session tokens. BreachHistory cites approximately 17M+ affected records in this row. See the fb2025oct and canonical BreachHistory entry.
2025 — 16B+
Cataloged incident. Aggregation of Stealer Logs published. Data stolen from users browsers (cookies/saved passwords) using Lumma/RedLine malware. Facebook logins were a primary target, enabling widespread session hijacking. Exposed categories include Passwords, Session tokens, Session cookies. BreachHistory cites approximately 16B+ affected records in this row. See the fb2025infostealer and canonical BreachHistory entry.
2025 — 1.2B records
Unverified claim — treat actor counts cautiously. A threat actor claimed to have bypassed modern Meta rate-limits to scrape 1.2 billion records. Meta contested the claim, but security firms confirmed much of the data was fresh (not in previous 2021 leaks). Exposed categories include Details not publicly disclosed. BreachHistory cites approximately 1.2B+ affected records in this row. See the fb2025api and canonical BreachHistory entry.
2024 — 26B records aggregated
Cataloged incident. The Mother of All Breaches (MOAB) consolidated decades of leaks into a 12TB database. Contains millions of Facebook credentials reused from older breaches or stolen via phish kits. Exposed categories include Credentials. BreachHistory cites approximately 26B+ affected records in this row. See the fb2024moab and canonical BreachHistory entry.
2023 — $725M Cambridge Analytica settlement opens for applications
Unverified claim — treat actor counts cautiously. Settlement for Cambridge Analytica privacy violations opened for claims in April 2023; submissions closed August 25. Exposed categories include Details not publicly disclosed. No attested victim count is published for this row yet. See the tfb2304 and canonical BreachHistory entry.
2021 — 530M+ user records leaked via contact importer scraping
Cataloged incident. Data on 530M+ users posted on a forum; scraped in 2019 by exploiting contact importer. Facebook fixed vulnerability by Sep 2019 but did not notify users. Ireland DPC fined Meta €265m (Nov 2022). Exposed categories include Names, phone numbers, email addresses, locations, user IDs. BreachHistory cites approximately 530M+ affected records in this row. See the tfb2104 and canonical BreachHistory entry.
2020 — Developers access inactive user data (90-day policy bug)
Cataloged incident. Bug allowed third-party developers to access data on inactive users if they were friends with active users. Violated post–Cambridge Analytica 90-day access policy. Fixed and disclosed July 1. Exposed categories include Details not publicly disclosed. No attested victim count is published for this row yet. See the tfb2006 and canonical BreachHistory entry.
2019 — 267M–309M Facebook accounts on dark web
Cataloged incident. 267M records found on dark web Dec 2019; 42M more in Mar 2020—same Vietnam-based group. API abuse or scraping. Exposed categories include Details not publicly disclosed. BreachHistory cites approximately 309M+ affected records in this row. See the tfb1912 and canonical BreachHistory entry.
2019 — 419M user records on exposed server
Cataloged incident. Unsecured server held Facebook ID, phone number, and in some cases name, country, gender for 419M users. Server not Facebook's; eventually taken down. Exposed categories include Phone numbers. BreachHistory cites approximately 419M+ affected records in this row. See the tfb1909 and canonical BreachHistory entry.
2019 — FTC $5B penalty and new privacy restrictions
Cataloged incident. FTC imposed $5B fine and mandated board-level restructuring, independent privacy committee, and new compliance officers. Largest FTC privacy penalty. Exposed categories include Details not publicly disclosed. No attested victim count is published for this row yet. See the tfb1907 and canonical BreachHistory entry.
2019 — April 2019 user data exposed on public servers
Cataloged incident. Facebook user data including phone numbers and other PII was found on public servers, likely scraped via a vulnerability that allowed enumeration of user IDs and associated data. The dataset was from before mid-2019 and included users from multiple countries. Exposed categories include Phone numbers, Personal identifiable information. BreachHistory cites approximately 533M+ affected records in this row. See the ctwv and canonical BreachHistory entry.
2019 — 1.5M users' email contacts uploaded without permission
Cataloged incident. Between May 2016 and 2019, Facebook uploaded 1.5M users' email contacts when users entered email password to verify; used for ads and friend recommendations. Exposed categories include Email addresses, Passwords. BreachHistory cites approximately 1.5M+ affected records in this row. See the tfb1904a and canonical BreachHistory entry.
2019 — Up to 600M passwords stored in plaintext
Cataloged incident. Up to 600M user passwords stored in plaintext, some since 2012; ~2k employees could view. Instagram passwords also stored in plaintext. Exposed categories include Passwords, Passwords (plain text), Employee data, Internal documents. BreachHistory cites approximately 600M+ affected records in this row. See the tfb1903 and canonical BreachHistory entry.
2018 — September 2018 access token breach
Cataloged incident. Attackers exploited a vulnerability in the 'View As' feature that allowed them to steal Facebook access tokens. The bug was in the video uploader component that appeared in the context of View As; it incorrectly generated access tokens with the permissions of the user being viewed rather than the viewer. Attackers could then take over accounts. Exposed categories include Details not publicly disclosed. BreachHistory cites approximately 50M+ affected records in this row. See the bnpq and canonical BreachHistory entry.
2018 — Bug makes 14M users' private posts public
Cataloged incident. Glitch made 14M users' intended-to-be-private posts public. Bug tied to new feature rolled out May 18; fix rolled out May 22–27. Exposed categories include Details not publicly disclosed. BreachHistory cites approximately 14M+ affected records in this row. See the tfb1805 and canonical BreachHistory entry.
2018 — Cambridge Analytica data harvesting
Cataloged incident. Third-party app 'thisisyourdigitallife' collected data from users who took a personality quiz, and due to Facebook's Graph API at the time, also collected data from those users' friends without explicit consent. The data was then sold to Cambridge Analytica for political advertising. The vulnerability was in the platform's app permissions and friend data access policies. Exposed categories include Details not publicly disclosed. BreachHistory cites approximately 87M+ affected records in this row. See the axkm and canonical BreachHistory entry.
2018 — — Facebook: Malicious third-party scrapers collected profile…
Cataloged incident. Oct 2018. Malicious third-party scrapers collected profile information from many Facebook users. BreachHistory cites approximately 29M+ affected records in this row. See the facebook2018 and canonical BreachHistory entry.
2018 — 87M profiles
Cataloged incident. Cambridge Analytica harvested data via personality quiz app. Used for political advertising. $5B FTC fine. Exposed categories include Profile data, likes, friend connections. BreachHistory cites approximately 87M+ affected records in this row. See the facebook-cambridge2018 and canonical BreachHistory entry.
2013 — 6M contacts
Cataloged incident. A bug in the Download Your Information tool caused users private contact details (emails/phones) to be linked to wrong profiles. Users who downloaded their archive received contact info for people they were not friends with. Exposed categories include Email addresses, Phone numbers. BreachHistory cites approximately 6M+ affected records in this row. See the fb2013dyi and canonical BreachHistory entry.
2013 — — Facebook: Facebook discovered that hackers had exploited a…
Cataloged incident. Facebook discovered that hackers had exploited a vulnerability and accessed unspecified data. Facebook found no evidence that Facebook user data was compromised. Malware was installed on a number of employee laptops after a small number of them visited a mobile developer website that turned out to be unsafe. Microsoft, Twitter, and Apple were affected by the same issue around the same time. Exposed categories include Personal information. No attested victim count is published for this row yet. See the facebook2013 and canonical BreachHistory entry.
2011 — — Facebook: A 17-year old hacker was charged with various…
Cataloged incident. A 17-year old hacker was charged with various computer crimes. He somehow managed to access the Twitter, Facebook, PayPal and email accounts of multiple celebrities and other people. The teen was charged with cyberstalking, computer fraud, computer tampering and extortion. Exposed categories include Personal information. No attested victim count is published for this row yet. See the facebook2011 and canonical BreachHistory entry.
2010 — data breach (87,000,000+ records)
Cataloged incident. Facebook is listed in Wikipedia's "List of data breaches" for 2010 (87,000,000+ records). Organization type: social network. Method reported: [data misuse](https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Analytica_data_scandal "Facebook–Cambridge Analytica data scandal"). Details: 87,000,000. Exposed categories include 87,000,000. BreachHistory cites approximately 87M+ affected records in this row. See the facebook-2010-wiki and canonical BreachHistory entry.
2008 — — Facebook: Facebook accidentally publicly revealed personal…
Cataloged incident. Facebook accidentally publicly revealed personal information about its members, which could be useful to identity thieves. The full dates of birth of many of Facebook's 80 million active users were visible to others, even if the individual member had requested that the information remained confidential. Exposed categories include Personal information. BreachHistory cites approximately 80M+ affected records in this row. See the facebook2008 and canonical BreachHistory entry.
2005 — 70k profiles
Cataloged incident. MIT researchers used a script to scrape data from 70,000 profiles across four Ivy League schools. While not a hack, it was the first major demonstration of how Facebook architecture allowed bulk data harvesting. Exposed categories include Details not publicly disclosed. BreachHistory cites approximately 70K+ affected records in this row. See the fb2005mit and canonical BreachHistory entry.
Patterns and analysis
- Credential theft and social engineering — appears across multiple Facebook catalog entries; prioritize controls that address this class of failure.
- Cloud and database misconfiguration — appears across multiple Facebook catalog entries; prioritize controls that address this class of failure.
- Third-party and supply-chain exposure — appears across multiple Facebook catalog entries; prioritize controls that address this class of failure.
- Zero-day exploitation and malware — appears across multiple Facebook catalog entries; prioritize controls that address this class of failure.
- Unverified actor or scraping claims — appears across multiple Facebook catalog entries; prioritize controls that address this class of failure.
- Record-count hygiene — BreachHistory indexes actor-cited figures separately from company-confirmed totals; read each row's technicalWriteup before treating counts as fact.
- 2026 monitoring — New disclosures roll into this timeline as they are verified or labeled unverified per catalog policy.
What to do if you may be affected
- Step 1: Enable phishing-resistant MFA on every account tied to this brand.
- Step 2: Use unique passwords and a password manager—breach rows often involve credential reuse.
- Step 3: Monitor official company breach notices and regulator filings, not dark-web downloads.
- Step 4: Review OAuth app permissions and revoke unused third-party integrations.
- Step 5: Bookmark the Facebook company page for new 2026+ disclosures.
Canonical BreachHistory hub
Explore every indexed row: breachhistory.com/facebook · Latest: fb2025oct.
Sources: BreachHistory catalog (24 rows for Facebook), company and regulator disclosures cited in individual breach records.