(Reuters) - Facebook Inc (FB.O) said on Friday that hackers stole digital login codes allowing them to take over nearly 50 million user accounts in its worst security breach ever given the unprecedented level of potential access, adding to what has been a difficult year for the company’s reputation.

Facebook, which has more than 2.2 billion monthly users, said it has yet to determine whether the attacker misused any accounts or stole private information. It also has not identified the attacker’s location or whether specific victims were targeted. Its initial review suggests the attack was broad in nature.

Chief Executive Mark Zuckerberg described the incident as “really serious” in a conference call with reporters. His account was affected along with that of Chief Operating Officer Sheryl Sandberg, a spokeswoman said.

Shares in Facebook fell 2.6 percent on Friday, weighing on major Wall Street stock indexes.

Facebook made headlines earlier this year after profile details from 87 million users was improperly accessed by political data firm Cambridge Analytica. The disclosure has prompted government inquiries into the company’s privacy practices across the world, and fueled a “#deleteFacebook” social movement among consumers.

U.S. lawmakers said on Friday that the hack may boost calls for data privacy legislation.

“This is another sobering indicator that Congress needs to step up and take action to protect the privacy and security of social media users,” Democratic U.S. Senator Mark Warner said in a statement.

Related Coverage UK regulator to enquire if Facebook data breach has affected UK citizens

Federal Trade Commission Commissioner Rohit Chopra on Twitter said “I want answers” with a link to a Reuters story on the breach.

‘COMPLEX’ FLAW

Facebook’s latest vulnerability had existed since July 2017, but the company first identified it on Tuesday after spotting a “fairly large” increase in use of its “view as” privacy feature on Sept. 16, executives said.

“View as” allows users to verify their privacy settings by seeing what their own profile looks like to someone else. The flaw inadvertently gave the devices of “view as” users the wrong digital code, which, like a browser cookie, keeps users signed in to a service across multiple visits.

That code could allow the person using “view as” to post and browse from someone else’s Facebook account, potentially exposing private messages, photos and posts. The attacker also could have gained full access to victims’ accounts on any third-party app or website where they had logged in with Facebook credentials.

“The implications of this are huge,” Justin Fier, director of cyber intelligence at security company Darktrace, told Reuters.

Guy Rosen, the Facebook vice president overseeing security, said the flaw was “complex” in that it resulted from three failings.

FILE PHOTO: A 3D-printed Facebook logo is seen in front of displayed binary digits in this illustration taken March 18, 2018. REUTERS/Dado Ruvic/Illustration/File Photo

A video upload feature should not have displayed on a user’s profile page when accessed through “view as,” Rosen told reporters on a conference call. That alone would not have been problematic except that the video feature wrongly triggered the placement of the powerful login code. And it placed the code not for the “view as” user, but for who they were pretending to be.

Facebook fixed the issue on Thursday. It also notified the U.S. Federal Bureau of Investigation, Department of Homeland Security, Congressional aides and the Data Protection Commission in Ireland, where the company has European headquarters.

The Irish authority expressed concern in a statement that Facebook has been “unable to clarify the nature of the breach and risk to users” and said it was pressing Facebook for answers.

Facebook reset the digital keys of the 50 million affected accounts, and as a precaution temporarily disabled “view as” and reset those keys for another 40 million that have been looked up through “view as” over the last year.

About 90 million people will have to log back into Facebook or any of their apps that use a Facebook login, the company said.

Two Facebook users sued the company over the breach in federal court in California on Friday.

More than 6,000 users complained about the breach on Zuckerberg’s Facebook page.

“I’m so scared now. All my activities are on Facebook,” Mohammad ZR Zia, a 25-year-old college student in Kuala Lumpur, Malaysia, who has been using the social media platform since 2009, told Reuters. His account was logged out earlier on Friday.

FILE PHOTO - Figurines are seen in front of the Facebook logo in this illustration taken March 20, 2018. REUTERS/Dado Ruvic

The level of concern expressed on Facebook was enough that the company’s automated system temporarily blocked sharing of some articles about the breach.

“Our security systems have detected that a lot of people are posting the same content, which could mean that it’s spam,” a message told users. Facebook later apologized for the misfire.

Facebook has suffered narrower breaches before.

In 2013, Facebook disclosed a software flaw that exposed 6 million users’ phone numbers and email addresses to unauthorized viewers for a year, while a technical glitch in 2008 revealed confidential birth-dates on 80 million Facebook users’ profiles.</s>Attack gave hackers ability to take over accounts in what is believed to be largest breach in Facebook’s history

Nearly 50m Facebook accounts were compromised by an attack that gave hackers the ability to take over users’ accounts, Facebook revealed on Friday.

The breach was discovered by Facebook engineers on Tuesday 25 September, the company said, and patched on Thursday. Users whose accounts were affected will be notified by Facebook. Those users will be logged out of their accounts and required to log back in.

“I’m glad we found this and fixed the vulnerability,” Mark Zuckerberg said on a conference call with reporters on Friday morning. “But it definitely is an issue that this happened in the first place. I think this underscores the attacks that our community and our services face.”

The security breach is believed to be the largest in Facebook’s history and is particularly severe because the attackers stole “access tokens”, a kind of security key that allows users to stay logged into Facebook over multiple browsing sessions without entering their password every time. Possessing a token allows an attacker to take full control of the victim’s account, including logging into third-party applications that use Facebook Login.

The security breach comes at a time of significant strife for the social media company, which has faced mounting criticism over issues including foreign election interference, the flow of misinformation, hate speech, and data privacy.

The revelation that a political consultancy linked to the US president, Donald Trump, had obtained the personal information of tens of millions of Facebook users prompted widespread concern that the company was cavalier in its approach to privacy.

Instagram founders quit amid suspected clash with Zuckerberg Read more

“We have a responsibility to protect your data, and if we can’t then we don’t deserve to serve you,” Zuckerberg wrote in a public apology regarding the Cambridge Analytica breach.

﻿According to Facebook, the attacker exploited three bugs that were introduced into the site’s “view as” feature in July 2017. “View as” allows users to see what their profile looks like to other users. The company does not yet know when the hack took place, but it said that it began an investigation after discovering unusual activity on 16 September.

In addition to the 50m accounts whose access tokens were taken, Facebook said that it would require 40m additional users who used the “view as” tool since July 2017 to log out of their accounts as a precaution. This will reset those users’ access tokens, protecting their accounts.

The company has notified law enforcement, the vice-president of product management, Guy Rosen, said on the conference call. Rosen said that Facebook was working with the FBI, but he did not comment on whether national security agencies were involved in the investigation.

“The investigation is early, and it’s hard to discover who is behind this,” Rosen said. “We may never know.” He did note that the scale and complexity of the hack would have required “a certain level” of expertise.

Facebook Twitter Pinterest The breach was discovered by Facebook engineers on 25 September. Photograph: Regis Duvignau/Reuters

Dr Lukasz Olejnik, an independent cybersecurity and privacy researcher, said: “Anyone involved in this hack knew what he was doing.” Olejnik noted that whoever discovered the vulnerabilities would probably have been eligible for a “bug bounty” payment had they disclosed the bugs rather than exploited them.

Another key area of investigation is discovering the extent to which the hackers used the access tokens. The company says it has not yet seen evidence that the hackers accessed private messages or made posts on users’ behalf, but they did attempt to access certain profile information.

Rosen did not provide any details on the location of users affected, saying only that the attack seemed “broad” and investigators had not determined whether there were particular targets. The company has notified the Irish Data Protection Commission (DPC) about the breach. The implementation of Europe’s General Data Protection Regulation (GDPR) meant that Facebook was required to notify data protection authorities within 72 hours if any affected users were in the European Economic Area.

The Irish DPC was critical in its initial response to the breach, tweeting: “At present Facebook is unable to clarify the nature of the breach & risk to users. We are pressing Facebook to urgently clarify these matters.

News of the hack comes at the end of a week in which many of Facebook’s Silicon Valley peers testified before the US Congress about the possibility of consumer privacy regulations.

“Today’s disclosure is a reminder about the dangers posed when a small number of companies like Facebook or the credit bureau Equifax are able to accumulate so much personal data about individual Americans without adequate security measures,” said the US senator Mark Warner in a statement. “This is another sobering indicator that Congress needs to step up and take action to protect the privacy and security of social media users.”

Facebook shares fell about 3% following the disclosure.

Articles about the data breach by the Guardian and the Associated Press were temporarily flagged as spam on Facebook, preventing users from sharing news of the attack on their profiles. The company attributed the error to its “automated systems” and apologized, but did not provide further explanation.

﻿</s>NEW YORK (AP) — Facebook reported a major security breach in which 50 million user accounts were accessed by unknown attackers.

In a blog post, the company says hackers exploited a bug that affected its "View As" feature, which lets people see what their profiles look like to someone else. That would let attackers steal "access tokens," which are digital keys that Facebook uses to keep people logged in. Possession of those tokens would allow attackers to "seize control" of user accounts, Facebook said.

Specifically, from the "View As" feature, a bug somehow allowed a video uploader to appear for sending "happy birthday" messages, Guy Rosen, Facebook's vice president of product management said. Another bug then created an access token that made Facebook think the hacker had legitimately signed in with the account being viewed.

"We haven't yet been able to determine if there was specific targeting," Rosen said in a call with reporters. "It does seem broad. And we don't yet know who was behind these attacks and where they might be based."

Facebook says it has taken steps to fix the security problem and alerted law enforcement.

To deal with the issue, Facebook reset some logins, so 90 million people have been logged out and will have to log in again. That includes anyone who has been subject to a "View As" lookup in the past year.

Facebook says it doesn't know who is behind the attacks or where they're based. In a call with reporters on Friday, CEO Mark Zuckerberg said that the company doesn't know yet if any of the accounts that were hacked were misused.

Jake Williams, a security expert at Rendition Infosec, said the stolen access tokens would have likely allowed attackers to view private posts and probably to post status updates or shared posts as the compromised user, but wouldn't affect passwords.

"The bigger concern (and something we don't know yet) is whether third-party applications were impacted," Williams said in a text exchange. "Facebook offers a login service for third parties to allow users to log into their apps using Facebook. In other words, Facebook is providing the identity management for countless other sites and services. These access tokens that were stolen show when a user is logged into Facebook and that may be enough to access a user's account on a third party site."

The hack is the latest setback for Facebook during a year of tumult for the company.

News broke early this year that a data analytics firm that once worked for the Trump campaign, Cambridge Analytica, had improperly gained access to personal data from millions of user profiles. Then a congressional investigation found that agents from Russia and other countries have been posting fake political ads since at least 2016. Facebook CEO Mark Zuckerberg appeared at a Congressional hearing over Facebook's privacy policies in April.

Facebook has more than 2 billion users worldwide. The company said people do not need to change their Facebook passwords, but anyone having trouble logging on should visit the site's help center . Those who want to log out can visit the "Security and Login" section of their settings, which lists the places that people are logged into Facebook. It offers a one-click option of logging out of all locations.

Ed Mierzwinski, the senior director of consumer advocacy group U.S. PIRG, said the breach was "very troubling."

"It's yet another warning that Congress must not enact any national data security or data breach legislation that weakens current state privacy laws, preempts the rights of states to pass new laws that protect their consumers better, or denies their attorneys general rights to investigate violations of or enforce those laws," he said in a statement.

Wedbush analyst Michael Pachter said "the most important point is that we found out from them," meaning Facebook, as opposed to a third party.

"As a user, I want Facebook to proactively protect my data and let me know when it's compromised," he said. "Shareholders should ultimately approve of Facebook's handling of the issue."</s>NEW YORK — Facebook says 50 million user accounts have been affected by a security breach.

By The Associated Press</s>NEW YORK (AP) — Facebook reported a major security breach in which 50 million user accounts were accessed by unknown attackers.

The attackers gained the ability to “seize control” of those user accounts, Facebook said, by stealing digital keys the company uses to keep users logged in. They could do so by exploiting three distinct bugs in Facebook’s code.

The company said it has fixed the bugs and logged out the 50 million breached users — plus another 40 million who were vulnerable to the attack — in order to reset those digital keys. Users don’t need to change their Facebook passwords, it said.

Facebook said it doesn’t know who was behind the attacks or where they’re based. In a call with reporters on Friday, CEO Mark Zuckerberg — whose own account was compromised — said that attackers would have had the ability to view private messages or post on someone’s account, but there’s no sign that they did.

“We do not yet know if any of the accounts were actually misused,” Zuckerberg said.

The hack is the latest setback for Facebook during a tumultuous year of security problems and privacy issues . So far, though, none of these issues have significantly shaken the confidence of the company’s 2 billion global users.

This latest hack involved bugs in Facebook’s “View As” feature, which lets people see how their profiles appear to others. The attackers used that vulnerability to steal the digital keys, known as “access tokens,” from the accounts of people whose profiles were searched for using the “View As” feature. The attack then moved along from one user’s Facebook friend to another. Possession of those tokens would allow attackers to control those accounts.

One of the bugs was more than a year old and affected how the “View As” feature interacted with Facebook’s video uploading feature for posting “happy birthday” messages, said Guy Rosen, Facebook’s vice president of product management. But it wasn’t until mid-September that Facebook noticed an uptick in unusual activity, and not until this week that it learned of the attack, Rosen said.

“We haven’t yet been able to determine if there was specific targeting” of particular accounts, Rosen said in a call with reporters. “It does seem broad. And we don’t yet know who was behind these attacks and where they might be based.”

Neither passwords nor credit card data was stolen, Rosen said. He said the company has alerted the FBI and regulators in the United States and Europe.

Jake Williams, a security expert at Rendition Infosec, said he is concerned that the hack could have affected third party applications.

Williams noted that the company’s “Facebook Login” feature lets users log into other apps and websites with their Facebook credentials. “These access tokens that were stolen show when a user is logged into Facebook and that may be enough to access a user’s account on a third party site,” he said.

Facebook confirmed late Friday that third party apps, as well as its own Instagram app, could have been affected.

“The vulnerability was on Facebook, but these access tokens enabled someone to use the account as if they were the account-holder themselves,” Rosen said.

News broke early this year that a data analytics firm once employed by the Trump campaign, Cambridge Analytica, had improperly gained access to personal data from millions of user profiles. Then a congressional investigation found that agents from Russia and other countries have been posting fake political ads since at least 2016. In April, Zuckerberg appeared at a congressional hearing focused on Facebook’s privacy practices.

The Facebook bug is reminiscent of a much larger attack on Yahoo in which attackers compromised 3 billion accounts — enough for half of the world’s entire population. In the case of Yahoo, information stolen included names, email addresses, phone numbers, birthdates and security questions and answers. It was among a series of Yahoo hacks over several years.

U.S. prosecutors later blamed Russian agents for using the information they stole from Yahoo to spy on Russian journalists, U.S. and Russian government officials and employees of financial services and other private businesses.

In Facebook’s case, it may be too early to know how sophisticated the attackers were and if they were connected to a nation state, said Thomas Rid, a professor at the Johns Hopkins University. Rid said it could also be spammers or criminals.

“Nothing we’ve seen here is so sophisticated that it requires a state actor,” Rid said. “Fifty million random Facebook accounts are not interesting for any intelligence agency.”

Ed Mierzwinski, the senior director of consumer advocacy group U.S. PIRG, said the breach was “very troubling.”

“It’s yet another warning that Congress must not enact any national data security or data breach legislation that weakens current state privacy laws, pre-empts the rights of states to pass new laws that protect their consumers better, or denies their attorneys general rights to investigate violations of or enforce those laws,” he said in a statement.

Wedbush analyst Michael Pachter said “the most important point is that we found out from them,” meaning Facebook, as opposed to a third party.

“As a user, I want Facebook to proactively protect my data and let me know when it’s compromised,” he said.

An earlier version of this article incorrectly stated the day of Mark Zuckerberg’s call with reporters.

O’Brien reported from Providence, Rhode Island. Frank Bajak in Boston contributed to this report.</s>Facebook has said that an attack on its network has affected almost 50 million user accounts, exposing their personal information. The breach could allow attackers to take over the accounts of affected users. The full extent of the attack remains unknown at this time.

The social media giant said that the security breach was discovered earlier this week on Tuesday. The company found that the attackers had exploited a feature in Facebook’s code that impacted ‘View As’, which lets people see what their own profile looks like to others. The attackers exploited the vulnerability, which leaked Facebook access token, giving attackers access to users’ accounts.

In a conference call with reports, Mark Zukerberg, CEO of Facebook, said, “We’re taking it really seriously. We have a major security effort at the company that hardens all of our surfaces. I’m glad we found this. But it definitely is an issue that this happened in the first place.”

Currently the company’s internal investigation “is still in its early stages” and it has provided no details regarding who might be behind the attack or what user data (if any) was exfiltrated. Facebook has not revealed where in the world the affected 50 million users are, but says that it has informed Irish data regulators, where Facebook’s European subsidiary is based.

Over 90 million users were forced to log out of their accounts on Friday, which is a common security measure when accounts have been compromised. However, the users were not required to change their passwords.

The company said that it has fixed the vulnerability and has also notified law enforcement officials. It has temporarily disabled the View As feature while the company conducts a thorough security review. Facebook says that peoples’ privacy and security are very important and apologises for the incident.

Read More: WhatsApp co-founder Brian Acton feels he sold users’ privacy with Facebook acquisition

The news about security breach comes at a time when Facebook is going through a rough time. It is currently facing federal investigation over its role in the Cambridge Analytica scandal in which the firm misused data from about 87 million Facebook users.</s>Facebook says it recently discovered a security breach affecting nearly 50 million user accounts.

In a blog post, the company says hackers exploited its “View As” feature, which lets people see what their profiles look like to someone else.

Facebook says it has taken steps to fix the security problem and alerted law enforcement.

To deal with the issue, Facebook reset some logins, so 90 million people have been logged out and will have to log in again.

That includes anyone who has been subject to a “View As” lookup in the past year.

Facebook says it doesn’t know who’s behind the attacks or where they’re based.

The hack is the latest security headache for Facebook, which has been dealing with political disinformation campaigns from Russia and elsewhere since 2016.</s>Social media giant says it has taken steps to fix the security problem and alerted law enforcement

Facebook says it recently discovered a security breach affecting nearly 50 million user accounts.

The hack is the latest setback for Facebook during a year of tumult for the global social media service.

In a blog post , the company says hackers exploited a bug that affected its “View As” feature, which lets people see what their profiles look like to someone else. That would let attackers steal the “access tokens” Facebook uses to keep people logged in. Possession of those tokens would allow attackers to “seize control” of user accounts, Facebook said.

Facebook says it has taken steps to fix the security problem and alerted law enforcement.

To deal with the issue, Facebook reset some logins, so 90 million people have been logged out and will have to log in again. That includes anyone who has been subject to a “View As” lookup in the past year.

Facebook says it doesn’t know who is behind the attacks or where they’re based. In a call with reporters on Friday, CEO Mark Zuckerberg said that the company doesn’t know yet if any of the accounts that were hacked were misused.

Jake Williams, a security expert at Rendition Infosec, said the stolen access tokens would have likely allowed attackers to view private posts and probably post status updates or shared posts as the compromised user, but wouldn’t affect passwords.

“The bigger concern (and something we don’t know yet) is whether third party applications were impacted,” Williams said in a text exchange. “Facebook offers a login service for third parties to allow users to log into their apps using Facebook. In other words, Facebook is providing the identity management for countless other sites and services. These access tokens that were stolen show when a user is logged into Facebook and that may be enough to access a user’s account on a third party site.

News broke early this year that data analytics firm that once worked for the Trump campaign, Cambridge Analytica, had gained access to personal data from millions of user profiles. Then a congressional investigation found that agents from Russia and other countries have been posting fake political ads since at least 2016. Facebook CEO Mark Zuckerberg appeared at a Congressional hearing over Facebook’s privacy policies in April.

Facebook has more than 2 billion users worldwide. The company said people do not need to change their Facebook passwords, but anyone having trouble logging on should visit the site’s help centre . Those who want to log out can visit the “Security and Login” section of their settings, which lists the places that people are logged into Facebook. It has a one-click option of logging out of all locations.

Ed Mierzwinski, the senior director of consumer advocacy group U.S. PIRG, said the breach was “very troubling.”

“It’s yet another warning that Congress must not enact any national data security or data breach legislation that weakens current state privacy laws, preempts the rights of states to pass new laws that protect their consumers better, or denies their attorneys general rights to investigate violations of or enforce those laws,” he said in a statement.

Wedbush analyst Michael Pachter said “the most important point is that we found out from them,” meaning Facebook, as opposed to a third party.

“As a user, I want Facebook to proactively protect my data and let me know when it’s compromised,” he said. “Shareholders should ultimately approve of Facebook’s handling of the issue.”

Like us on Facebook and follow us on Twitter.</s>As many as 90 million Facebook users will have to log back into their accounts after the social network admitted on Friday that hackers had stolen the security tokens associated with 50 million user profiles.

As a precaution, Facebook has reset the security tokens for the 50 million accounts as well as for 40 million others.

The attackers exploited Facebook's systems through a flaw in the company's "View As" feature, the company said, which allows a Facebook user to view his or her own profile as a friend, the public or another third party might see it.

While Facebook is still conducting its investigation, the company said it learned that the hackers used the feature to steal the access tokens that allow a user to reopen Facebook without having to log back in.

The incident prompted Facebook to disable the "View As" feature for the time being, and users are not being asked to change their passwords.

"People's privacy and security is incredibly important, and we're sorry this happened," Facebook said in a blog post. It's why we've taken immediate action to secure these accounts and let users know what happened."</s>A security breach has affected nearly 50 million Facebook accounts, the tech giant revealed Friday.

According to Facebook, their engineering team discovered on Tuesday that attackers had exploited the "View As" feature on the service, allowing them to steal "Facebook access tokens" which could be used to take over people's accounts.

Facebook says it has taken steps to fix the security problem and alerted law enforcement.

As a result, Facebook reset the access tokens for the affected accounts and another 40 million accounts that used the "View as" feature in the last year.

In total, around 90 million people were automatically logged out and will have to log back into Facebook, or any of their apps that use Facebook login.

The company said there's no need for anyone to change their passwords.

Facebook said it's investigation is still in its early stages and they aren't sure if any accounts were misused.

"We also don’t know who’s behind these attacks or where they’re based," Facebook's VP of Product Management, Guy Rosen, said in an online post.

This is a breaking news story that will be updated.
Facebook uncovers a security flaw, impacting 50 million user accounts which may have been compromised.