Facebook data breach

Risk level: Medium 46/100

What happened

In April 2021, a large data set of over 500 million Facebook users was made freely available for download. Scraped by exploiting a vulnerability Facebook advises was rectified in August 2019, the data contained phone numbers and other personal attributes for users in over 100 countries.

Breach date: 1 August 2019
Date added: 4 April 2021
Compromised accounts: 509,458,528
Domain: facebook.com

Compromised data

Dates of birth
Email addresses
Employers
Genders
Geographic locations
Job titles
Names
Phone numbers
Relationship statuses

Breach attributes

Verified

Recommended steps if you were in the Facebook breach:

Security remediation checklist

Work through these steps, most urgent first:

Turn on two-factor authentication (authenticator app or security key) wherever it is offered.
Ask your mobile carrier for a SIM-swap / port-out PIN to protect your phone number.
Watch for identity fraud: unexpected letters, credit applications or accounts in your name.
Expect targeted phishing emails that mention this breach. Do not click unexpected links.
Be wary of scam SMS messages and calls (smishing / vishing) that use your details.
Review the privacy settings of your online accounts and limit what is publicly visible.
Keep an eye on your accounts for logins or changes you do not recognise.
Subscribe to breach alerts so you hear about future breaches quickly.