← Facebook

530M+ user records leaked via contact importer scraping

2021 530.0M records affected Share on X

Data compromised

Names, phone numbers, email addresses, locations, user IDs

Technical writeup

Data on 530M+ users posted on a forum; scraped in 2019 by exploiting contact importer. Facebook fixed vulnerability by Sep 2019 but did not notify users. Ireland DPC fined Meta €265m (Nov 2022).

Root cause

Contact importer abuse; scraping; no user notification.

References