What Really Caused Facebook’s 500M-User Data Leak ?
▻https://www.wired.com/story/facebook-data-leak-500-million-users-phone-numbers
Facebook’s initial response was simply that the data was previously reported on in 2019 and that the company patched the underlying vulnerability in August of that year. Old news. But a closer look at where, exactly, this data comes from produces a much murkier picture. In fact, the data, which first appeared on the criminal dark web in 2019, came from a breach that Facebook did not disclose in any significant detail at the time
[...]
the recently public trove of 533 million records is an entirely different data set that attackers created by abusing a flaw in a Facebook address book contacts import feature. Facebook says it patched the vulnerability in August 2019, but it’s unclear how many times the bug was exploited before then.
[...]
“It’s a fallacy to think that a breach isn’t serious just because it doesn’t have passwords in it or other maximally sensitive data,” says Zack Allen, director of threat intelligence at the security firm ZeroFox. “It’s also a fallacy to say that a situation isn’t that bad just because it’s old data. And furthermore, phone numbers scare the crap out of me as a form of authentication, which unfortunately is how they’re often used these days.”