PCMag UK | News & Analysis | News
Facebook: 30 Million Account Tokens Stolen, Not 50 Million
By Michael Kan
That's great, but 14 million people still had a ton of data stolen, including device types used to access Facebook, education, the last 10 places they checked into or were tagged in, people or Pages they follow, and the 15 most recent searches accessed.
Facebook on Friday provided an update on a recent breach to say that 30 million people had their Facebook access tokens stolen rather than the previously announced 50 million.
Tokens are digital keys that keep you logged in to Facebook so you don't have to re-enter your password every time you open the app. With an access token, an attacker could take over your account and use it as if they were you.
But while Facebook was able to lower the number of people affected, that's cold comfort for the remaining 30 million. Of that total, 1 million people did not have any information accessed, while 15 million people had their name and contact details (phone number, email, or both, depending on what people had on their profiles) accessed.
SEE ALSO: SimpliSafe Launches $169 Video Doorbell Pro
The situation is worse for the remaining 14 million users; they had their name and contact details exposed, as well as username, gender, locale/language, relationship status, religion, hometown, self-reported current city, birthdate, device types used to access Facebook, education, work, the last 10 places they checked into or were tagged in, website, people or Pages they follow, and the 15 most recent searches accessed.
Facebook will notify the 30 million people affected with customized messages to tell them exactly what the attackers accessed from their accounts. Or you can click this link while signed into Facebook and scroll down.
"This attack did not include Messenger, Messenger Kids, Instagram, WhatsApp, Oculus, Workplace, Pages, payments, third-party apps, or advertising or developer accounts," Facebook vice president of product management Guy Rosen said in blog post—with one exception.
If an affected person was a Page admin whose Page received a message from someone over Facebook, then the hackers would've been able to view the content.
"We're cooperating with the FBI, which is actively investigating and asked us not to discuss who may be behind this attack," Rosen said.
The mysterious hackers exploited three software vulnerabilities in the company's code involving the "View As" feature, which lets you see what your profile looks like to the public or a specific individual. According to Rosen, the attackers first stole access to about 400,000 Facebook accounts, which they used as a launching pad to collect profile data from 29 million people. The attack began on Sept. 14, but Facebook only realized it was a threat by Sept. 25.
Rosen said Facebook has seen no evidence yet that the hackers have been using the stolen data. He declined to offer a location breakdown of where affected users live, but said the attack was fairly broad.
To protect users, Facebook reset the access tokens to 90 million users' accounts. Check whether you were affected by the breach by visiting the company's Help Center.
SimpliSafe Launches $169 Video Doorbell Pro
Don't Fall for This Email Sextortion Scam
Weak Default Logins Expose Internet Cameras to Hacking
Report: Chinese Spies Infected Apple, Amazon Using Tiny Chips
Michael Kan michael_kan@pcmag.com
Michael has been a PCMag reporter since October 2017. He previously covered tech news in China from 2010 to 2015, before moving to San Francisco to write about cybersecurity. See Full Bio
More From Michael Kan
NBC's Peacock Arrives in July as Free, Ad-Based Streaming Service
Firefox's Developer Mozilla Lays Off 70 Staffers