Personal data of 12 million Facebook users exposed online

Security 1 comments

The leak came after a misconfigured Elasticsearch server exposed Facebook users’ data involved in a previous breach.

For the last few years, Facebook has been embroiled in a range of controversies ranging from the social network’s hegemony over the internet to scandals like that of Cambridge Analytica in 2018. Not to forget just a few weeks ago a hacker was found selling personal data of 267 million Facebook users.

To tackle these, the company claims to take certain measures but despite that, slips here and there have continued to occur.

The latest in this episode was reported by Safety Detectives whose research team headed by Anurag Sen discovered that the data of 12 million Facebook users based in Vietnam has been leaked.

See: Stolen: Unencrypted hard drives with data of 29,000 Facebook employees

According to the researchers, the data was found on an Elasticsearch server and includes records found in a previous breach of Vietnamese users in January 2020.

However, not all of it is from Facebook and multiple sources are believed to be at play. Further, the details of how the perpetrators managed to scrape such a large amount are not known yet.

Amounting to over 3GB, most of the data includes personally identifiable information (PII) with the following records:

  • Full name
  • Hometown location
  • Current location
  • Education details
  • Birthdates
  • GPS coordinates
  • Email addresses
  • Facebook usernames and IDs
  • Profile scores
  • Facebook usernames and IDs
  • Family relations with other Facebook users

Here is a preview of the leaked data shared by Safety Detectives:

1 of 4

In their blog post, Safety Detectives raised concerns on the data breach staing that,

Facebook decided to lock down some of its API functions, including data scraping, in order to make this practice more difficult to conduct and blocked users from using its reverse search tool. […] Clearly, there are still data-scraping vulnerabilities that can be exploited, especially where there is a mismatch of security protocols being implemented by third-party websites and Facebook.

All of these can have significant repercussions such as the attackers blackmailing the victims with personal details, conducting sophisticated phishing attacks aided by social engineering, spamming users with both marketing and malicious messages.

But, that’s not it, even physically endangering someone’s security through the GPS coordinates revealed if they represent enough interest to the attackers.

To conclude, for the time being, the server has been taken down. Currently, we believe that Facebook yet again needs to ramp up its pen-testing capabilities and do a review of the data it allows third parties to access even for legitimate purposes.

See: Unsecured database leaks phone numbers of 419 million Facebook users

As users, we can limit the type of information we share with any website considering that everything is hackable. Moreover, we are yet to hear Facebook’s reaction to these latest revelations and will keep on updating you.

Did you enjoy reading this article? Do like our page on Facebook and follow us on Twitter.

Facebook Twitter LinkedIn Pinterest
Sudais Asif

Marketing Director at Homemade Cuisine | Cybersecurity Writer | I like to read books, debate, and write content.

1 Comment
  1. Maria
    May 25, 2020 at 12:21 am

    I wish these hackers would put their obvious talents to better use !! There’s so much corruption in this world that could be exposed, One of the biggest threats to our world is the infiltration of world governments by Zionists, why not do the world a favour and expose these individuals !!?? Such talents could be put to better use to benefit mankind as a whole.