Facebook Security Bug Affected 6 Million Users

A security bug in Facebook allowed access to user’s personal information (contact numbers and email) to other users connected to them, and is said to have affected 6 million accounts. The bug, said to have been active since last year, and lay undiscovered until now. However, it was fixed within a day of discovery. The security team highlighted the bug in a detailed blogpost here.

When people upload their contact lists or address books to Facebook, we try to match that data with the contact information of other people on Facebook in order to generate friend recommendations. Because of the bug, some of the information used to make friend recommendations and reduce the number of invitations we send was inadvertently stored in association with people’s contact information as part of their account on Facebook. As a result, if a person went to download an archive of their Facebook account through our Download Your Information (DYI) tool, they may have been provided with additional email addresses or telephone numbers for their contacts or people with whom they have some connection. This contact information was provided by other people on Facebook and was not necessarily accurate, but was inadvertently included with the contacts of the person using the DYI tool.

The bug was brought to Facebook’s notice by external security researchers, and says it was not exploited maliciously. Facebook has responded by dispatching emails to all 6 million affected user accounts. It reads:

Dear ___, Your privacy is incredibly important to everyone who works at Facebook, and we’re dedicated to protecting your information. While many of us focus our full-time jobs on preventing or fixing issues before they affect anyone, we recently fell short of our goal and a technical bug caused your telephone number or email address to be accessible by another person. The bug was limited in scope and likely only allowed someone you already know outside of Facebook to see your email address or telephone number. That said, we let you down and we are taking this error very seriously. Here is your contact Information (inadvertently accessible by at most 1 Facebook user): [Phone number] [Email address 1] [Email address 2] We estimate that 1 Facebook user saw this additional contact info displayed next to your name in their downloaded copy of their account information. No other info about you was shown and it’s likely that anyone who saw this is not a stranger to you, even if you’re not friends on Facebook. We recognize that mistakenly sharing contact info is unacceptable, even if you are acquainted with people who saw these details, and we’ve taken measures to prevent this from happening again. For more information on the bug, please read our blog post. All of us at Facebook take this issue very personally. We appreciate your ongoing use of Facebook, and are working every day to deliver the level of service you expect and deserve. Thank you, The Facebook Team

However, security researchers have come out to say that Facebook has been downplaying the magnitude of the incident. According to them, more than 1 persons would have obtained access to user records and information. Facebook has declined to respond.