The data includes phone numbers, full names, location, email address, and biographical information.
Security researchers warn that the data could be used by hackers to impersonate people and commit fraud.
On Saturday, a user posted hundreds of millions of Facebook users in the low-level hacking forum online, free of charge, telephone numbers, and personal information.
Over 533 million Facebook users in over 106 countries received personal information from the United States, including 32 million records, 11 million Facebook users, and 6 million Indian users. Personal information was disclosed. Their telephone numbers, Facebook IDs, full names, addresses, date of birth, biological information, and sometimes emails are included.
Insider examined a sample of data leakage by checking the known Facebook telephone numbers with the data set IDs and confirming several records by references. We also twice check records by putting the Facebook password reset data set to the test with email addresses, which may partially be used to reveal a user’s number.
According to a Facebook Spokesperson, the data has been removed due to a vulnerability patched by the company in 2019.
The leaked data could provide valuable info for cybercriminals using personal information to transmit them or to scam them for the handing-over of login credentials, according to Alon Gal, chief of cybercrime intelligence company Hudson Roc, who discovered the entire trough of leaked data online on Saturday.
“There would be almost certainly a database with the personal information of many Facebook users, such as telephone numbers, which would lead to bad actors using the data to make [or] hack attacks on social engineering [or],” Gal told Insider.
In January, Gal first learned about the data leak when another user advertised an automated bot in the same hacking forum, which could fee hundreds of millions of Facebook users for telephone numbers. Motherboard then reported on the existence of the bot and confirmed that the data were correct.
The whole dataset has now been freely made available to anyone with rudimentary data skills on the hacking forum.
Initiators tried to telegram the leaker but received no answer.
This is not the first time that numbers of Facebook users are found on the Internet. This is the first time. A vulnerability identified in 2019 allowed millions of people’s phone numbers to be scraped on their servers in breach of Facebook’s services terms. According to Facebook, the vulnerability was corrected in August this year.
When, during the election of 2016, Cambridge Analytica dismissed 80 million user data in violation of Facebook’s terms of service, Facebook promised to attack mass data scrapping.
From a security point of view, Gal said Facebook could only assist users who have been affected by this violation because the data is already out – but he said Facebook could inform users so that they are in search of phishing schemes or of fraud involving their personal information.
“They trust their data when they sign up for a reputable company such as Facebook, and Facebook should treat these data with the greatest respect,” Gal explained. “When users’ personal information is leaked, it is a huge breach of trust and should be treated like this.”