sb-eu logo
Story image

Millions of Facebook user records exposed in latest data leak

04 Apr 2019

In the latest major blow to Facebook’s reputation, cybersecurity company UpGuard has today revealed that two third-party-developed Facebook app datasets were found exposed to the public on the Internet.

On a blog post on its website, the UpGuard Cyber Risk team said the first lead was from Mexico-based media company Cultura Colectiva.

The 146GB file contained over 540 million records detailing comments, likes, reactions, account names, Facebook IDs, and more, not unlike the data provided in the Cambridge Analytica scandal a year ago.

The blog post also details a separate backup from a Facebook-integrated app titled “At the Pool” exposed to the public internet via an Amazon S3 bucket.

The data covered large swathes of users’ Facebook activity, including likes, friends, interests, check-ins, and their passwords for the app in question.

UpGuard reported that each of the data sets was stored in its own Amazon S3 bucket configured to allow public download of files.

Both sets of data were available to third-party developers.

“As Facebook faces scrutiny over its data stewardship practices, they have made effort to reduce third-party access. But as these exposures show, the data genie cannot be put back into the bottle,” the statement says.

“Data about Facebook users has been spread far beyond the bounds of what Facebook users can control today.”

UpGuard said it contacted Cultura Colectiva about the data leak twice in January but has yet to receive a response.

AWS was then notified of the leak in January and responded three days later saying that the owner of the data had been notified, but the data remained publicly available.

The data was finally secured in April after Bloomberg contacted Facebook for comment.

The data from the second leak via the At the Pool app was taken offline during the time UpGuard was conducting its investigation.

The app in question has been offline since 2014 and the company’s website returns a 404 error notice.

“These two situations speak to the inherent problem of mass information collection: the data doesn’t naturally go away, and a derelict storage location may or may not be given the attention it requires,” UpGuard said in its statement.

“For Cultura Colectiva, data on responses to each post allows them to tune an algorithm for predicting which future content will generate the most traffic.

“The data exposed in each of these sets would not exist without Facebook, yet these data sets are no longer under Facebook’s control,” UpGuard said.

“In each case, the Facebook platform facilitated the collection of data about individuals and its transfers to third parties, who because responsible for its security.”

Facebook most recently came under fire for its lack of response to the Christchurch mosque shootings, when the shooter used Facebook's Live feature to broadcast his massacre in real time.

Although Facebook worked to remove as many copies of the video as possible after it was notified, the social media giant came under fire for violating New Zealand’s privacy laws.

“Your silence is an insult to our grief,” said New Zealand privacy commissioner John Edwards in a missive to Facebook executives for their lack of engagement and accountability for their part in the incident.

Story image
Phishing scam imitates SharePoint & OneNote for nefarious clicks
Sophos researchers say that the attackers take a slightly different approach to the standard ‘fake login’ phishing email.More
Story image
Check Point acquires Odo Security to bolster remote security offering
The deal will integrate Odo’s remote access software with Check Point’s Inifinity architecture, bolstering the latter company’s remote security capabilities in a time where working and learning from home has become the norm, and looks to largely remain that way in the near future.More
Story image
Radware issues security alert, warning of global rise of DDoS-for-hire
Efforts from corporations, law enforcement and independent researchers around the world have attempted in the last two years to curb this growth – but the industry keeps growing says Radware information security researcher Daniel Smith.More
Story image
Video: 10 Minute IT Jam – F-Secure talks APTs and the Lazarus Group
We spoke to F-Secure's director of detection and response, Matt Lawrence.More
Story image
Malware and email scams targeting employees spread rapidly in Q2
"Businesses must stay alert and should employ defense-in-depth tactics and equip themselves with multilayered security mechanisms, including high-sensor spam filters and a VPN connection, which would prevent malicious pages from opening."More
Story image
Proofpoint and CyberArk extend partnership to further safeguard high-risk users
“Our CyberArk partnership extension provides security teams with increased detection and enhanced adaptive controls to help prevent today’s most severe threats."More