500 Million Facebook Users Phone Numbers Leaked, On Sale Via Telegram Bot

Taking advantage of an earlier vulnerability on the social media major Facebook, miscreants have managed to extrapolate the mobile phone numbers of nearly 500 million Facebook users. These numbers are now reportedly on sale through a Telegram bot.

(Representative Image: Reuters)

A new report by Motherboard backed with research by security researcher Alon Gal highlights the data leak. As per the report, the data includes numbers of around 6 lakh Indian Facebook users and has been online for several years now.

Even though the data is old, the cybersecurity and privacy risk associated with it is still relevant to those whose data has been leaked. That is because mobile phone users always aim to stick to their phone number for convenience. The information being sold through the Telegram bot is hence likely to still be accurate.

The phone numbers can certainly be used for smishing and other fraudulent activities by bad actors, warns Gal. Gal reported that users from over 100 countries have been affected by the data leak. In India, over 6,162,450 users have been a victim of the data leak.

The data leak took place because of a vulnerability with Facebook which was patched in August 2019, as per the company. Facebook told Motherboard that it patched the vulnerabilities at the time and tested the bot against it, returning no results after the fix. Users who shared their contacts with the platform before that are still vulnerable.

Reuters

The exploit enabled bad actors to create a database of contact numbers of Facebook users across countries. The Telegram bot selling the data said "The bot helps to find out the cellular phone numbers of Facebook users," as per Motherboard's tests.

Those using the bot could thus either use a phone number to know the corresponding Facebook ID, or vice versa. The user could buy credits to reveal these phone numbers, with prices of the credit ranging from $20 for one credit to $5,000 for 10,000 credits.

Gal further highlights that the issue is even more worrisome as many potential victims are unaware about it. "It is important that Facebook notify its users of this breach so they are less likely to fall victim to different hacking and social engineering attempts," Gal said.