Facebook CEO Mark Zuckerberg (C) leaves the office of Sen. Dianne Feinstein (D-CA) after meeting on Capitol Hill on April 9, 2018 in Washington, DC. Facebook on Thursday said millions of Instagram user passwords were exposed to employees in a searchable format in an internal database. The announcement came in an update to a blog post that was published last month after the company disclosed millions of Facebook user passwords were exposed to employees. The blog post originally said thousands of Instagram passwords were exposed. Cybersecurity journalist Brian Krebs reported in March that up to 600 million Facebook passwords were exposed. Facebook said in the blog post it would be notifying the millions more Instagram users whose passwords were exposed. The company also said its internal investigation determined that the passwords were not "abused or improperly accessed." However, thousands of Facebook employees would have had access to the passwords, and Facebook hasn't provided an update to its investigation since it was originally reported in March. Facebook's stock was down less than half a percent Thursday afternoon.<doc-sep>Facebook says it stored millions of Instagram users’ passwords in plain text, leaving them exposed to people with access to certain internal systems. The security lapse was first reported last month, but at the time, Facebook said it only happened to “tens of thousands of Instagram users,” whereas the number is now being revised up to “millions.” The issue also affected “hundreds of millions of Facebook Lite users” and “tens of millions of other Facebook users.” Passwords are supposed to be stored in an encrypted format that allows websites to confirm what you’re entering without directly reading it. But as Krebs on Security first reported, various errors seem to have caused Facebook’s systems to log some passwords in plain text since as early as 2012. Facebook noticed the problem in January and said in March that the issue had been resolved. “We simply learned there were more passwords stored in this way.” The passwords were stored within Facebook and were accessible to more than 20,000 employees, according to Krebs. Facebook says it investigated access to the passwords, and that it found “no evidence of abuse or misuse.” It also says no passwords were exposed externally. Facebook doesn’t seem to be actively recommending that people change their passwords. “This is an issue that has already been widely reported, but we want to be clear that we simply learned there were more passwords stored in this way,” a Facebook spokesperson said in a statement. Today’s update just expands the scope of the security lapse. Facebook has had a particularly bad year when it comes to security issues — Cambridge Analytica, a giant hack, another hack — and this news comes the same day that we found out Facebook had been accessing and storing some users’ email contacts without their permission, after encouraging users to hand over their email address passwords. Facebook says it’ll be contacting all the people whose Instagram passwords were improperly stored.<doc-sep>Given the terrible run of form it’s been on over the last year, it probably shouldn’t be that surprising that Facebook waited until the highly anticipated report on Russian interference in the 2016 US presidential election to deliver some bad news. While just about every reporter was poring over the document, Facebook updated a blog post from March indicating that passwords had been exposed, stored as readable text (as opposed to securely encrypted), for hundreds of millions of Facebook users and thousands of Instagram users. It added a new paragraph to the middle of the post today indicating that a lot more Instagram users were affected than it originally thought: (Update on April 18, 2019 at 7AM PT: Since this post was published, we discovered additional logs of Instagram passwords being stored in a readable format. We now estimate that this issue impacted millions of Instagram users. We will be notifying these users as we did the others. Our investigation has determined that these stored passwords were not internally abused or improperly accessed). Just a small update from “thousands” to “millions,” then. Facebook said it would notify the impacted users and that there’s no evidence that anyone within or outside Facebook had access to the passwords. But still, those users, and perhaps anyone else, might want to change their password or enable two-factor authentication just to make sure. That’s never a bad idea anyway.<doc-sep>
(Image credit: Shutterstock) Security incidents often follow a familiar pattern. Companies find out they weren't as secure as they thought, inform their users about the issue and later discover the incident affected more people than originally estimated. Facebook's disclosure of problems with the way it stored passwords followed that same pattern, with the company revealing yesterday that millions of Instagram users were also affected by its security blunder. Facebook originally said in March that up to 20,000 employees could have accessed the passwords of more than 600 million people. They wouldn't even have to do anything to make the data readable either because it was stored in plain text. The company essentially left keys to the digital lives of half a billion people lying around for any of its employees to use as they saw fit. We're pretty sure that's the opposite of secure. Then, on April 18 the company updated its March blog post with more information: "Since this post was published, we discovered additional logs of Instagram passwords being stored in a readable format. We now estimate that this issue impacted millions of Instagram users. We will be notifying these users as we did the others. Our investigation has determined that these stored passwords were not internally abused or improperly accessed." The company didn't say when it discovered that Instagram users were also affected; it could've been anytime between March 21 and April 18. Nor did Facebook mention the issue on social media, republish the blog post to make it clear that it was updated, or inform journalists of the change. It wouldn't be too far-fetched to think Facebook was hoping the media would be focusing its attention elsewhere so this disclosure would go unnoticed. This disclosure perfectly matches the process we outlined above. At this point it's probably safe to assume a few things whenever companies disclose security incidents. It's seems like they're always worse than they expect, they're always going to downplay the severity of an incident and there's always the chance that further disclosures go unnoticed because they were made when people shifted their attention to whatever's grabbing headlines.