itb-au logo
Story image

Millions of Facebook user records exposed in latest data leak

04 Apr 2019

In the latest major blow to Facebook’s reputation, cybersecurity company UpGuard has today revealed that two third-party-developed Facebook app datasets were found exposed to the public on the Internet.

On a blog post on its website, the UpGuard Cyber Risk team said the first lead was from Mexico-based media company Cultura Colectiva.

The 146GB file contained over 540 million records detailing comments, likes, reactions, account names, Facebook IDs, and more, not unlike the data provided in the Cambridge Analytica scandal a year ago.

The blog post also details a separate backup from a Facebook-integrated app titled “At the Pool” exposed to the public internet via an Amazon S3 bucket.

The data covered large swathes of users’ Facebook activity, including likes, friends, interests, check-ins, and their passwords for the app in question.

UpGuard reported that each of the data sets was stored in its own Amazon S3 bucket configured to allow public download of files.

Both sets of data were available to third-party developers.

“As Facebook faces scrutiny over its data stewardship practices, they have made effort to reduce third-party access. But as these exposures show, the data genie cannot be put back into the bottle,” the statement says.

“Data about Facebook users has been spread far beyond the bounds of what Facebook users can control today.”

UpGuard said it contacted Cultura Colectiva about the data leak twice in January but has yet to receive a response.

AWS was then notified of the leak in January and responded three days later saying that the owner of the data had been notified, but the data remained publicly available.

The data was finally secured in April after Bloomberg contacted Facebook for comment.

The data from the second leak via the At the Pool app was taken offline during the time UpGuard was conducting its investigation.

The app in question has been offline since 2014 and the company’s website returns a 404 error notice.

“These two situations speak to the inherent problem of mass information collection: the data doesn’t naturally go away, and a derelict storage location may or may not be given the attention it requires,” UpGuard said in its statement.

“For Cultura Colectiva, data on responses to each post allows them to tune an algorithm for predicting which future content will generate the most traffic.

“The data exposed in each of these sets would not exist without Facebook, yet these data sets are no longer under Facebook’s control,” UpGuard said.

“In each case, the Facebook platform facilitated the collection of data about individuals and its transfers to third parties, who because responsible for its security.”

Facebook most recently came under fire for its lack of response to the Christchurch mosque shootings, when the shooter used Facebook's Live feature to broadcast his massacre in real time.

Although Facebook worked to remove as many copies of the video as possible after it was notified, the social media giant came under fire for violating New Zealand’s privacy laws.

“Your silence is an insult to our grief,” said New Zealand privacy commissioner John Edwards in a missive to Facebook executives for their lack of engagement and accountability for their part in the incident.

Story image
Going back to work: Why we need to rethink enterprise ID cards
Australia and New Zealand are opening up again, and office workers are going back to their desks. Meanwhile, many companies still rely on outdated legacy card issuance systems, which offer little functionality or security assurances, and printing processes can be cumbersome.More
Story image
Why enabling a remote workforce requires converging security at the edge
Fast-tracking an agile yet more secure remote workforce requires a recognition of the fundamental importance of cloud services and mobile access play for today’s users. More
Link image
Employee distraction, remote work & cyber risk - a recipe for disaster?
Moving your workforce out of the corporate office can bring big changes and potential risks in how they save their data. It is important that your IT team plan these changes with your employees.More
Story image
Interview: Checkmarx on the state of software security in Asia Pacific
"While the benefits of software are obvious, this proliferation also creates a massive and ever-evolving attack surface,” says Checkmarx A/NZ country manager Raygan Flores.More
Download image
Ultimate security: The best authentication just got better
Cloud applications can hold sensitive data, and top-notch authentication is key. But having separate tools for separate applications can be cumbersome - here's how to overcome that.More
Story image
In a post-COVID world, process automation is a must, says K2
K2 and Forrester explain the myriad benefits of accelerating digital transformation towards process automation strategies in their new webinar.More