A user in a hacking forum has published the phone numbers and personal data of hundreds of millions of Facebook users for free online, Business Insider reported Saturday.
The exposed data includes personal information of over 533 million Facebook users from 106 countries, including over 32 million records on users in the US, 11 million on users in the UK, and 6 million on users in India. It includes their phone numbers, Facebook IDs, full names, locations, birthdates, bios, and in some cases email addresses.
Insider reviewed a sample of the leaked data and verified several records by matching known Facebook users’ phone numbers with the IDs listed in the data set. The business news website also verified records by testing email addresses from the data set in Facebook’s password reset feature, which can be used to partially reveal a user’s phone number.
Reuters was not immediately able to vet the information, which is being offered for a few euros’ worth of digital credit on a well-known site for low-level hackers, but Alon Gal, CTO of cybercrime intelligence firm Hudson Rock, said he had verified the authenticity of at least some of the data by comparing it against phone numbers of people he knew.
The leaked data could provide valuable information to cybercriminals who use people’s personal information to impersonate them or scam them into handing over login credentials, according to Gal who first discovered the leaked data on Saturday.
Facebook FB, +1.40% did not immediately respond to multiple requests for comment by Business Insider or Axios or Reuters.
Gal first discovered the leaked data in January when a user in the same hacking forum advertised an automated bot that could provide phone numbers for hundreds of millions of Facebook users in exchange for a price. Motherboard reported on that bot’s existence at the time and verified that the data was legitimate.
Now, the entire dataset has been posted on the hacking forum for free, making it widely available to anyone with rudimentary data skills.
It’s not the first time that a huge number of Facebook users’ phone numbers have been found exposed online. A vulnerability that was uncovered in 2019 allowed millions of phone numbers to be scraped from Facebook servers in violation of its terms of service, TechCrunch reported. Facebook said that vulnerability was patched in August 2019.