267 million Facebook users’ phone numbers were illegally exposed

Millions of phone numbers publicly listed by Facebook users were shared in an online forum where hackers hang out.

A database containing more than 267 million Facebook phone numbers and user IDs were by cybersecurity firm Comparitech in partnership with security researcher Bob Diachenko.

Many Facebook users publicly list their phone numbers, but an easily accessible database like this helps malicious actors in spam and phishing schemes.

Researchers aren’t sure how the database was created. It could have been illegally compiled through an automated process called scraping, where public information is copied from the internet, in this case from Facebook profiles. 

It could have also been created through the Facebook API, a tool that gives third-party developers access to user information so they can create Facebook applications. The API stopped giving access to user phone numbers in 2018, so it’s possible the data was collected before the new policy was enacted.

Researchers believe the operation was being run by a criminal organization in Vietnam.

The database was not password protected and was completely open to the public. Diachenko usually notifies the owner of an exposed database so they can secure it. However, in this case, the owners of the database were illegally maintaining it. So, the researcher directly informed the internet service provider managing the IP address of the server where the database was stored, and it was taken down on Dec. 19. Diachenko believes the illegal database was set public by mistake.

Facebook users who have their phone number set to public should be cautious of phone calls and text messages from unknown numbers, as the information could be used in spam or phishing campaigns.

Facebook has been hit with a number of issues this year. A similar database containing more than 400 million Facebook user IDs and phone numbers was in September. 

While publicly scraped data is harder for companies like Facebook to stop, there were other where this information was accessed through the social network’s own developer API. For example, this past April, millions of Facebook user records, including , were discovered. The data was exposed by third-party app developers.

Comparitech recommends that Facebook users set their privacy settings to “friends” or “only me” as well as turning off the option that allows search engines to link to your profile. This will help reduce the risk of your data being accessed by third parties. 

However, the cybersecurity firm notes that the only way to be sure that it never happens is to deactivate or delete your Facebook profile.