Facebook Uncovered a New Hack That Affected 50 Million Accounts

This is the biggest data breach the company has seen since Cambridge Analytica.

Ting Shen/Xinhua/ZUMA Wire

On Friday, Facebook announced it had discovered a security breach that had affected at least 50 million accounts. The company told reporters the breach was first discovered Tuesday after an investigation was launched earlier this month when engineers noticed “suspicious” activity on the platform. The original security vulnerabilities, which allowed hackers to access user accounts, were traced back to a video feature introduced in June 2017 that allowed users to share “Happy Birthday” videos.

The security breach allowed hackers to log in to user accounts through stolen “access tokens,” which are saved to browsers so users may remain logged onto the site. Facebook says the attack affected 50 million accounts that had used its “View As” feature, which allows users to see what their own profile looks like to someone else. An additional 40 million accounts that used the site’s “View As” feature were also logged out, though Facebook said it has not determined that hackers accessed those accounts. Access was also reset for Instagram and Occulus accounts linked to Facebook.

Guy Rosen, Facebook’s vice president of product management, told reporters Friday the company notified the FBI and Irish Data Protection Commission on Wednesday. By Thursday night, the vulnerability was fixed.

But much is still unknown about who is behind the attack or their intentions. Rosen told reporters that hackers were only able to access user profile information—such as gender, location, and date of birth—and no passwords or credit card information were breached. Rosen also told reporters Facebook was unable to say if the hackers targeted users in a specific region, or how many of the accounts breached were actually used by hackers. “We don’t know exactly if they’re using just those, or if it’s a part of a set of steps they may be taking in the future,” Rosen said.

Facebook declined to speculate if a nation state was involved with the attack or why certain profiles were targeted, but did say it was likely that automation was used due to the scale of the attack.

The hack comes months after it was revealed that a data breach allowed for political consulting firm Cambridge Analytica to access the private information of up to 87 million users, which has left the company scrambling to rebuild user trust. “Security is an arms race, and we’re continuing to improve our defenses,” Facebook CEO Mark Zuckerberg said during a press call Friday. “I think that this underscores there are constant attacks where people trying to take over accounts steal information in our community.”

So far, lawmakers have seemed unimpressed with the company’s response. While the Federal Trade Commission has not made any official announcement regarding the matter, FTC Commissioner Rohit Chopra tweeted, “I want answers.” Sen. Mark Warner (D-Va.), who as vice chair of the Senate Intelligence Committee has been leading the conversation about regulating technology companies after their role in foreign interference in the 2016 election, called the news “deeply concerning.”

“This is another sobering indicator that Congress needs to step up and take action to protect the privacy and security of social media users. As I’ve said before—the era of the Wild West in social media is over,” Warner said in a written statement.

The news comes just days after representatives from companies including Facebook, Twitter, and Amazon testified in front of the Senate Committee on Commerce, Science, and Transportation to discuss different approaches to better safeguarding consumer data.

This article has been updated.

One More Thing

And it's a big one. Mother Jones is launching a new Corruption Project to do deep, time-intensive reporting on the corruption that is both the cause and result of the crisis in our democracy.

The more we thought about how Mother Jones can have the most impact right now, the more we realized that so many stories come down to corruption: People with wealth and power putting their interests first—and often getting away with it.

Our goal is to understand how we got here and how we might get out. We're aiming to create a reporting position dedicated to uncovering corruption, build a team, and let them investigate for a year—publishing our stories in a concerted window: a special issue of our magazine, video and podcast series, and a dedicated online portal so they don't get lost in the daily deluge of headlines and breaking news.

We want to go all in, and we've got seed funding to get started—but we're looking to raise $500,000 in donations this spring so we can go even bigger. You can read about why we think this project is what the moment demands and what we hope to accomplish—and if you like how it sounds, please help us go big with a tax-deductible donation today.

We Recommend


Sign up for our newsletters

Subscribe and we'll send Mother Jones straight to your inbox.

Get our award-winning magazine

Save big on a full year of investigations, ideas, and insights.


Support our journalism

Help Mother Jones' reporters dig deep with a tax-deductible donation.