Facebook says 20 million fewer accounts were breached than originally thought in one of the worst security incidents at the giant social network – 30 million instead of 50 million – but attackers made off with sensitive personal information from nearly half of those users that could put them at serious risk, including phone number and email address, recent searches on Facebook, location history and the types of devices people used to access the service.
According to USA Today, hackers got their hands on data from 29 million accounts as part of last month’s attack, Facebook disclosed Friday. Facebook originally estimated that 50 million accounts could have been affected but the company didn’t know if they had been compromised.
For about half of those whose accounts broken into – some 14 million people – the hackers looted extensive personal information such as the last 10 places that Facebook user checked into, their current city and their 15 most recent searches. For the other 15 million, hackers accessed name and contact details, according to Facebook. Attackers didn’t take any information from about 1 million people whose accounts were affected. Facebook says hackers did not gain access to financial information, such as credit-card numbers.
The company would not say what the motive of the attackers was but said it had no reason to believe the attack was related to the November midterm elections.
Facebook users can check if their data was stolen by visiting the company’s Help Center. Facebook says it will advise affected users on how they can protect themselves from suspicious emails and other attempts to exploit the stolen data. Guy Rosen, Facebook’s vice president of product management, said the company hasn’t seen any evidence of attackers exploiting the stolen data or that it had been posted on the dark web.
Affected users should be on the lookout for unwanted phone calls, text messages or emails from people they don’t know and attempts to use their email address and phone number to target spam or attempts to phish for other information. Facebook users should also be wary of messages or emails claiming to be from Facebook, the company said.
Third-party apps and Facebook apps such as Instagram and WhatsApp were not compromised, according to Facebook. Hackers were not able to access any private messages but messages received or exchanged by Facebook page administrators may have been exposed.
Security experts say the 14 million users who had extensive personal information swiped are now extremely vulnerable. Colin Bastable, CEO of Lucy Security, which focuses on cybersecurity prevention and awareness, painted an especially grim scenario.
“The truth is that, as a result of this news, millions of phishing attacks will now be launched, pretending to be from Facebook. Up to 20 percent of recipients will click and a large number of those will be successfully attacked, many of them using work computers and mobile devices,” Bastable said. “Businesses and governments will lose money, ransomware attacks will result from this leak, and the attack will reverberate over many months.”
The culprits behind the massive hack have not been publicly identified. The FBI is actively investigating the hack and asked Facebook not to disclose any information about potential perpetrators, Rosen said. When they disclosed the breach two weeks ago, Facebook officials said they didn’t know who was behind the attacks.
The latest disclosure, another in a series of security lapses that have shaken public confidence in Facebook, may intensify political heat on the company. An investigation is underway by Ireland’s Data Protection Commission, and Rosen said Facebook is also cooperating with the Federal Trade Commission and other authorities. The FTC declined to comment if it’s investigating.
“Today’s update from Facebook is significant now that it is confirmed that the personal data of millions of users was taken by the perpetrators of the attack,” Ireland’s Data Protection Commission, the watchdog agency charged with privacy protection in the European Union, said in a tweet.
The extent of the personal information compromised by attackers delivered a blow to the public relations campaign Facebook has been waging to convince the more than 2 billion people who regularly use the service that it’s serious about protecting their personal information after the accounts of 87 million users were accessed by political targeting firm Cambridge Analytica without their consent and Russian operatives spread propaganda during and after the 2016 presidential election.
This week, Google acknowledged that half a million accounts on its Google + social network could have been compromised by a software bug. The admission prompted lawmakers to call for an FTC investigation. Both incidents could further fuel a congressional push for a national privacy law to protect U.S. users of tech company services.
“These companies have a staggering amount of information about Americans. Breaches don’t just violate our privacy, they create enormous risks for our economy and national security,” Federal Trade Commission Commissioner Rohit Chopra told USA TODAY after Facebook disclosed the data breach last month. “The cost of inaction is growing, and we need answers.”
More: Facebook breach puts your identity at risk. Here’s what you can do to protect yourself
More: Largest Facebook hack ever turns up heat on Mark Zuckerberg
More: Facebook’s 50 million account breach is already its biggest ever — and may get even worse
More: Midterms: ‘Furious’ Democrats purchase blitz of Facebook ads on Kavanaugh, far outpacing GOP spending
After the accounts were compromised last month, more than 90 million users were forced to log out of their accounts as a security measure.
Facebook says attackers exploited a feature in its code that allowed them to commandeer users’ accounts. Those accounts included Facebook CEO Mark Zuckerberg and his second-in-command, Sheryl Sandberg.
The attack began Sept. 14. A spike in traffic triggered an internal investigation. More than a week later, on Sept. 25, Facebook identified the vulnerability and fixed it two days later.
The vulnerability was introduced in July 2017 when a feature was added that allows users to upload happy birthday videos.
Attackers exploited a vulnerability in Facebook’s code that affected “View As,” a feature that lets people see what their own profile looks like to someone else. The feature was built to give users more control over their privacy. Three software bugs in Facebook’s code connected to this feature allowed attackers to steal Facebook access tokens they could then use to take over people’s accounts.
These access tokens are like digital keys that keep people logged in to Facebook so they don’t need to re-enter their password every time they use Facebook.
Here’s how it worked: Once the attackers had access to a token for one account, call it Jane’s, they could then use “View As” to see what another account, say Tom’s, could see about Jane’s account. The vulnerability enabled the attackers to get an access token for Tom’s account as well, and the attack spread from there. Facebook said it has turned off the “View As” feature as a security precaution.
Last month, Facebook reset the tokens of nearly 50 million accounts that it believed were affected and, as a precaution, also reset the tokens for another 40 million accounts that had used “View As” in the past year. Resetting the tokens logged the affected Facebook users out of the service.
A breach of this kind is not a single, isolated event, warned Adrien Gendre, CEO of Vade Secure North America, an email security company. Hackers don’t profit from breaking into Facebook accounts. Money’s made, he noted, by launching spear phishing attacks using the data they’ve purloined, an increasingly common form of cyberattack where hackers spoof someone’s identity to get them to complete a write transfer or share confidential information.
And that’s very bad news for the 14 million Facebook users who had intimate personal information stolen.
-USA Today
