1.5M users' email contacts uploaded without permission
Data compromised
Email addresses, Passwords
Technical writeup
Between May 2016 and 2019, Facebook uploaded 1.5M users' email contacts when users entered email password to verify; used for ads and friend recommendations.
Root cause
Email verification flow harvested contacts without consent.