Researcher: Data on 267 million Facebook users exposed

A Ukrainian security researcher reported finding a database with the names, phone numbers and unique user IDs of more than 267 million Facebook users — nearly all U.S.-based — on the open internet. That data was likely harvested by criminals, said researcher Bob Diachenko, an independent security consultant in Kyiv.

Posted: Dec 20, 2019 4:53 PM

A Ukrainian security researcher reported finding a database with the names, phone numbers and unique user IDs of more than 267 million Facebook users — nearly all U.S.-based — on the open internet. That data was likely harvested by criminals, said researcher Bob Diachenko, an independent security consultant in Kyiv.

The database, which Diachenko discovered with a search engine, was freely accessible online for at least 10 days beginning Dec. 4, he said. He notified the internet provider where it was hosted when he found it on Dec. 14; five days later it was no longer available.

Diachenko said someone downloaded the database to a hacker forum two days before he discovered it so it may have been shared among online thieves.

He first reported the finding Thursday in partnership with the U.K. tech news website Comparitech, which editor Paul Bischoff said has been helping write up Diachenko’s discoveries of unsecured databases for about a year.

The researcher provided the AP with a 10-record sample from the database and the IDs — and two phone numbers that were answered — checked out against real Facebook users.

The evidence suggests the data was collected illegally, most likely by criminals in Vietnam who may have “scraped” it from public Facebook pages or by somehow obtaining privileged access to the service. Scraping is automated data-harvesting done by bots. A small fraction of the database include details on Vietnam-based users.

Diachenko said he did not share the database with Facebook, which did not directly confirm the finding. In a statement, the social network said it was investigating the issue and that the finding “likely” involved information obtained before Facebook took unspecified data-protection measures in recent years.

In 2018, the social media giant disabled a feature that allowed users to search for one another via phone number following revelations that the political firm Cambridge Analytica had accessed information on up to 87 million Facebook users without their knowledge or consent.

Diachenko said he had not determined when the data was collected. He said all the records had time stamps from January to June 2019 but that it was unclear who generated them.

Security experts say the affected Facebook users are at higher risk of being targeted by spam, password-stealing phishing attacks and identity theft attempts. The information can be cross-referenced with physical and email addresses and other data obtained in other data breaches. Facebook user IDs are unique numbers associated with individual accounts.

In September, the news site TechCrunch reported that Facebook IDs and phone numbers for more than 400 million users were similarly found exposed online by a researcher.

In March, Facebook disclosed that it had left hundreds of millions of user passwords readable by its employees on internal severs for years after a security researcher exposed the lapse.

Terre Haute
Clear
41° wxIcon
Hi: 66° Lo: 47°
Feels Like: 41°
Robinson
Clear
42° wxIcon
Hi: 65° Lo: 45°
Feels Like: 42°
Indianapolis
Clear
44° wxIcon
Hi: 64° Lo: 49°
Feels Like: 40°
Rockville
Overcast
40° wxIcon
Hi: 65° Lo: 47°
Feels Like: 40°
Casey
Clear
46° wxIcon
Hi: 64° Lo: 47°
Feels Like: 43°
Brazil
Clear
41° wxIcon
Hi: 65° Lo: 46°
Feels Like: 41°
Marshall
Clear
41° wxIcon
Hi: 65° Lo: 47°
Feels Like: 41°
Nice and sunny today!
WTHI Planner
WTHI Temps
WTHI Radar

WTHI Events

 

Illinois Coronavirus Cases

(Widget updates once daily at 7 p.m. CT)

Confirmed Cases: 292082

Reported Deaths: 8858
CountyConfirmedDeaths
Cook1443155217
DuPage17589561
Lake16953487
Will14045378
Kane13159326
St. Clair6665190
Winnebago6037149
Madison5760137
Champaign473320
McHenry4609118
Peoria351050
McLean329523
Rock Island302676
Kankakee275277
Unassigned2532244
Sangamon243245
Kendall202025
Tazewell178025
LaSalle172557
DeKalb159038
Macon156044
Coles147231
Williamson140645
Jackson126224
Clinton119020
Adams114910
Boone112823
Randolph94111
Effingham8722
Vermilion7914
Whiteside75320
Ogle7286
Monroe68016
Knox6723
Grundy6705
Henry6665
Morgan66223
Bureau65211
Jefferson62038
Marion5661
Christian55411
Macoupin5507
Franklin5413
Stephenson5296
Union51524
McDonough48215
Logan4681
Crawford4584
Woodford4266
Fayette4183
Livingston4036
Cass39811
Jersey39415
Shelby3944
Lee3831
Montgomery37613
Iroquois36719
Perry35315
Saline3464
Warren3332
Bond3305
Douglas3147
Wayne2805
Jo Daviess2662
Lawrence2592
Carroll2355
Greene22911
Cumberland2185
Hancock2183
Moultrie2183
Washington2161
Jasper2139
Richland2136
Pulaski1811
Fulton1780
Clark1742
White1690
Wabash1583
Clay1560
Johnson1560
Mason1531
Mercer1405
Piatt1390
Pike1341
De Witt1252
Menard1251
Edgar1138
Massac1132
Ford1055
Marshall1050
Alexander831
Scott790
Gallatin732
Hamilton712
Henderson690
Edwards640
Brown620
Calhoun600
Putnam570
Stark552
Schuyler500
Hardin400
Pope291
Out of IL20

Indiana Coronavirus Cases

(Widget updates once daily at 8 p.m. ET)

Confirmed Cases: 118322

Reported Deaths: 3591
CountyConfirmedDeaths
Marion21502767
Lake10688323
Elkhart6707111
St. Joseph6619113
Allen6330205
Hamilton4938109
Vanderburgh378131
Hendricks2766124
Monroe265536
Tippecanoe256613
Johnson2352124
Clark225957
Porter219947
Delaware200162
Cass19559
Vigo186827
Madison170375
LaPorte149141
Floyd139664
Warrick138242
Howard132663
Kosciusko125917
Bartholomew118457
Marshall101524
Dubois99919
Boone99146
Grant95134
Hancock94643
Noble93132
Henry81226
Jackson7739
Wayne77014
Morgan73438
Daviess68028
Shelby68029
Dearborn67528
LaGrange64011
Clinton62314
Harrison59224
Putnam58411
Gibson5355
Knox5289
Lawrence51629
Montgomery51121
DeKalb48811
White48714
Decatur45939
Miami4394
Greene42735
Fayette42313
Jasper4012
Scott39011
Steuben3907
Posey3460
Sullivan33812
Jennings31612
Franklin31325
Clay3085
Ripley3078
Orange28824
Whitley2826
Carroll27813
Adams2763
Wabash2728
Starke2717
Washington2701
Wells2674
Spencer2633
Jefferson2503
Huntington2473
Fulton2442
Tipton22822
Randolph2238
Perry22113
Jay1920
Newton17411
Owen1711
Martin1680
Pike1641
Rush1574
Vermillion1310
Fountain1292
Blackford1213
Pulaski1141
Crawford1100
Parke1072
Brown1043
Benton870
Ohio797
Union790
Switzerland690
Warren411
Unassigned0226