(Reuters) - Facebook Inc (FB.O) said on Friday that hackers stole digital login codes allowing them to take over nearly 50 million user accounts in its worst security breach ever given the unprecedented level of potential access, adding to what has been a difficult year for the company’s reputation. One of the bugs was more than a year old and affected how the “View As” feature interacted with Facebook’s video uploading feature for posting “happy birthday” messages, said Guy Rosen, Facebook’s vice president of product management. I think this underscores the attacks that our community and our services face.”

The security breach is believed to be the largest in Facebook’s history and is particularly severe because the attackers stole “access tokens”, a kind of security key that allows users to stay logged into Facebook over multiple browsing sessions without entering their password every time. The attackers gained the ability to “seize control” of those user accounts, Facebook said, by stealing digital keys the company uses to keep users logged in. The company has notified law enforcement, the vice-president of product management, Guy Rosen, said on the conference call. Facebook reset the digital keys of the 50 million affected accounts, and as a precaution temporarily disabled “view as” and reset those keys for another 40 million that have been looked up through “view as” over the last year. Attack gave hackers ability to take over accounts in what is believed to be largest breach in Facebook’s history

Nearly 50m Facebook accounts were compromised by an attack that gave hackers the ability to take over users’ accounts, Facebook revealed on Friday. In a call with reporters on Friday, CEO Mark Zuckerberg — whose own account was compromised — said that attackers would have had the ability to view private messages or post on someone’s account, but there’s no sign that they did. In addition to the 50m accounts whose access tokens were taken, Facebook said that it would require 40m additional users who used the “view as” tool since July 2017 to log out of their accounts as a precaution.
Facebook uncovers a security flaw, impacting 50 million user accounts which may have been compromised.