Facebook Now Revealed Hackers Stolen 29 Million Facebook Users Personal Data

Facebook now says hackers accessed 29 million Facebook users data by the recent data breach and stolen users personal details such as Email and phone number and other data what compromised user had in their accounts.

Facebook initially said Security breach allow hackers to steal more than 50 million accounts access tokens by exploiting the software vulnerability in “View As” feature between July 2017 and September 2018.

View as future could allow users to see how their profiles look like when some see their profile and the bug was exploited in this future by attackers.

Access tokens act as a digital key and it helps to people logged into Facebook without reenter their Facebook credentials in App.

This incident was discovered by Facebook September 14, 2018, and confirmed it as a cyber attack due to the vulnerability and they closed the vulnerability Within two days also stopped the attack.

Hackers Accessed 29 Million Facebook Users Data

Facebook now announced that, Attackers stolen exactly 29 Million Facebook users personal data, In this case, Initially Attackers controlled 400,000 people accounts and stealing the access token of their friends of those friends using an automated technique.

It allows automatically loaded those accounts mirroring what these 400,000 people would have seen when looking at their own profile which includes their lists of friends, the name of the recent Messenger conversations etc.

In this case, Message conversation is not available to the attackers but if the accessed account users have any page and they received any message to that page then it could be accessed by attackers.

According to Facebook Attackers used this 400,000 users token and move further lists of friends to steal access tokens for about 30 million people and accessed following data.

  • 15 million people – name and contact details (phone number, email, or both, depending on what people had on their profiles).
  • 14 million people – same two sets of information, as well as other details people had on their profiles. This included username, gender, locale/language, relationship status, religion, hometown, self-reported current city, birth date, device types used to access Facebook, education, work, the last 10 places they checked into or were tagged in, website, people or Pages they follow, and the 15 most recent searches

But they didn’t accessed any data from the rest of 1 million peoples and Facebook sent customized messages to the 30 million people affected to explain what information the attackers might have accessed and how to protect them.

This attack did not include Messenger, Messenger Kids, Instagram, WhatsApp, Oculus, Workplace, Pages, payments, third-party apps, or advertising or developer accounts. Facebook Said.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

CISA Warns of Palo Alto Networks PAN-OS Vulnerability Exploited in Wild

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority alert on a…

11 hours ago

US Treasury Department Breach, Hackers Accessed Workstations

The Biden administration confirmed that a Chinese state-sponsored hacking group breached the U.S. Treasury Department,…

13 hours ago

TrueNAS CORE Vulnerability Let Attackers Execute Remote Code

Security researchers Daan Keuper, Thijs Alkemade, and Khaled Nassar from Computest Sector 7 disclosed a…

17 hours ago

New Botnet Exploiting D-Link Routers To Gain Control Remotely

Researchers observed a recent surge in activity from the "FICORA" and "CAPSAICIN," both variants of…

1 day ago

Hackers Weaponize Websites With LNK File To Deliver Weaponized LZH File

The watering hole attack leverages a compromised website to deliver malware. When a user visits…

1 day ago

NFS Protocol Security Bypassed To Access Files From Remote Server

The NFS protocol offers authentication methods like AUTH_SYS, which relies on untrusted user IDs, and…

1 day ago