Story image

Millions of Facebook user records exposed in latest data leak

04 Apr 2019

In the latest major blow to Facebook’s reputation, cybersecurity company UpGuard has today revealed that two third-party-developed Facebook app datasets were found exposed to the public on the Internet.

On a blog post on its website, the UpGuard Cyber Risk team said the first lead was from Mexico-based media company Cultura Colectiva.

The 146GB file contained over 540 million records detailing comments, likes, reactions, account names, Facebook IDs, and more, not unlike the data provided in the Cambridge Analytica scandal a year ago.

The blog post also details a separate backup from a Facebook-integrated app titled “At the Pool” exposed to the public internet via an Amazon S3 bucket.

The data covered large swathes of users’ Facebook activity, including likes, friends, interests, check-ins, and their passwords for the app in question.

UpGuard reported that each of the data sets was stored in its own Amazon S3 bucket configured to allow public download of files.

Both sets of data were available to third-party developers.

“As Facebook faces scrutiny over its data stewardship practices, they have made effort to reduce third-party access. But as these exposures show, the data genie cannot be put back into the bottle,” the statement says.

“Data about Facebook users has been spread far beyond the bounds of what Facebook users can control today.”

UpGuard said it contacted Cultura Colectiva about the data leak twice in January but has yet to receive a response.

AWS was then notified of the leak in January and responded three days later saying that the owner of the data had been notified, but the data remained publicly available.

The data was finally secured in April after Bloomberg contacted Facebook for comment.

The data from the second leak via the At the Pool app was taken offline during the time UpGuard was conducting its investigation.

The app in question has been offline since 2014 and the company’s website returns a 404 error notice.

“These two situations speak to the inherent problem of mass information collection: the data doesn’t naturally go away, and a derelict storage location may or may not be given the attention it requires,” UpGuard said in its statement.

“For Cultura Colectiva, data on responses to each post allows them to tune an algorithm for predicting which future content will generate the most traffic.

“The data exposed in each of these sets would not exist without Facebook, yet these data sets are no longer under Facebook’s control,” UpGuard said.

“In each case, the Facebook platform facilitated the collection of data about individuals and its transfers to third parties, who because responsible for its security.”

Facebook most recently came under fire for its lack of response to the Christchurch mosque shootings, when the shooter used Facebook's Live feature to broadcast his massacre in real time.

Although Facebook worked to remove as many copies of the video as possible after it was notified, the social media giant came under fire for violating New Zealand’s privacy laws.

“Your silence is an insult to our grief,” said New Zealand privacy commissioner John Edwards in a missive to Facebook executives for their lack of engagement and accountability for their part in the incident.

Safety solutions startup wins ‘radical generosity’ funding
Guardian Angel Security was one of five New Zealand businesses selected by 500 women (SheEO Activators) who contributed $1100 each.
Hands-on review: The ruggedly tough CAT S61 smartphone
The driveway beckoned me, so I dropped the phone several times.  Back in the study, close examination has failed to reveal a single scratch.
How printing solutions can help save the planet
Y Soft has identified five key ways organisations can become more economical and reduce their environmental impact.
Is NZ’s tech industry starting to mature?
Technology is New Zealand’s fastest growing and third biggest industry.
How Kiwibank aims to enable greater digital inclusion
"Online tools can offer a more convenient and cheaper customer experience, but there can be barriers to usage."
Scammers targeting more countries in sextortion scam - ESET
The attacker in the email claims they have hacked the intended victim's device, and have recorded the person while watching pornographic content.
Inland Revenue to shut down services later this week
“There’s never an ideal time to shut down the tax system but we’re confident the changes will make any inconvenience worthwhile.”
NZ managers prefer intuition to big data, Massey study finds
Many senior managers in New Zealand businesses have an inherent distrust of big data, opting instead to rely on their own intuition.