A huge database of Facebook users’ phone numbers found online

Hundreds of milli­ons of phone numbers linked to Face­book accounts have been found online.

The expo­sed server contai­ned more than 419 million records over seve­ral data­ba­ses on users across geograp­hies, inclu­ding 133 million records on U.S.-based Face­book users, 18 million records of users in the U.K., and anot­her with more than 50 million records on users in Viet­nam.

But because the server wasn’t protec­ted with a pass­word, anyone could find and access the data­base.

Each record contai­ned a user’s unique Face­book ID and the phone number listed on the account. A user’s Face­book ID is typi­cally a long, unique and public number asso­ci­a­ted with their account, which can be easily used to discern an account’s user­name.

But phone numbers have not been public in more than a year since Face­book restric­ted access to users’ phone numbers.

Tech­Crunch veri­fied a number of records in the data­base by matching a known Face­book user’s phone number against their listed Face­book ID. We also chec­ked other records by matching phone numbers against Face­book’s own pass­word reset feature, which can be used to parti­ally reveal a user’s phone number linked to their account.

Some of the records also had the user’s name, gender and loca­tion by country.

This is the latest secu­rity lapse invol­ving Face­book data after a string of inci­dents since the Cambridge Analy­tica scan­dal, which saw more than 80 million profi­les scra­ped to help iden­tify swing voters in the 2016 U.S. presi­den­tial elec­tion.

Since then the company has seen seve­ral high-profile scra­ping inci­dents, inclu­ding at Insta­gram, which recently admit­ted to having profile data scra­ped in bulk.

This latest inci­dent expo­sed milli­ons of users’ phone numbers just from their Face­book IDs, putting them at risk of spam calls and SIM-swap­ping attacks, which relies on tric­king cell carri­ers into giving a person’s phone number to an attac­ker. With some­one else’s phone number, an attac­ker can force-reset the pass­word on any inter­net account asso­ci­a­ted with that number.

Sanyam Jain, a secu­rity rese­ar­cher and member of the GDI Foun­da­tion, found the data­base and contac­ted Tech­Crunch after he was unable to find the owner. After a review of the data, neit­her could we. But after we contac­ted the web host, the data­base was pulled offline.

Jain said he found profi­les with phone numbers asso­ci­a­ted with seve­ral cele­bri­ties.

Face­book spokes­per­son Jay Nancar­row said the data had been scra­ped before Face­book cut off access to user phone numbers.

“This data set is old and appe­ars to have infor­ma­tion obtai­ned before we made chan­ges last year to remove people’s ability to find others using their phone numbers, ” the spokes­per­son said. “The data set has been taken down and we have seen no evidence that Face­book accounts were compro­mi­sed.”

But ques­ti­ons remain as to exac­tly who scra­ped the data, when it was scra­ped from Face­book and why.

Face­book has long restric­ted deve­lo­pers‘ access to user phone numbers. The company also made it more diffi­cult to search for friends’ phone numbers. But the data appe­a­red to be loaded into the expo­sed data­base at the end of last month — though that doesn’t neces­sa­rily mean the data is new.

This latest data expo­sure is the most recent exam­ple of data stored online and publicly without a pass­word. Although often tied to human error rather than a mali­ci­ous breach, data expo­su­res never­the­less repre­sent an emer­ging secu­rity problem.

In recent months, finan­cial giant First Ameri­can left data expo­sed, as did Movi­e­Pass and the Senate Demo­crats.