A data breach that was discovered by Facebook’s engineering team last Tuesday has affected over 50 million accounts, according to the company’s announcement on Friday.
In the statement, they revealed the magnitude of the breach in detail and assured their users that the matter would be treated with the seriousness it deserves.
Already, several Facebook users have been asked to log back into their accounts as the social media company resets the tokens of the accounts believed to have been compromised in the attack.
The breach occurred when an unspecified group of hackers exploited the “View As” feature on the platform, which allows users to see a preview of how their profiles look like to other Facebook users. Hackers exploited this feature to obtain access tokens—digital keys responsible for keeping users logged into their account.
The hackers would then be able to use these access tokens to take over victims’ accounts.
Counter-Measures in Place
Facebook Vice President of Product Management Guy Rosen explained in a security advisory that the company is already taking measures to guarantee users’ account safety following the breach.
First, the access tokens of the 50 million accounts that were compromised have been reset (many users report being asked to log back into their accounts after the incident).
Additionally, the “View As” feature will be temporarily disabled as the social media company patches the vulnerability.
Facebook will also be looking into 40 million more accounts, which they believe might have been compromised using the “View As” feature in the last year, bringing the total number of accounts to be reset to almost 100 million.
Facebook Working with Federal Investigators
CEO of Facebook Mark Zuckerberg announced the breach through his Facebook page shortly after it had been discovered.
In the post, he assured Facebook users that the matter was being treated with the seriousness it warranted and that he was glad they discovered it early enough.
One of the first steps taken by the company when they discovered the data breach was to inform the Federal Bureau of Investigation, a protocol that is reportedly commonplace during events like these. The Irish Data Protection Commission was also looped in.
The breach comes as Facebook tightens the belt around misinformation campaigns believed to be carried out by Russian hackers in preparation for the November midterms. Although Rosen could not directly confirm nor deny who these hackers are or where they’re based, he admitted that the level of complexity to leverage the access tokens was advanced.
Facebook’s History of Data Breaches
This is the third major data breach Facebook has announced within a short period.
It comes days after Zuckerberg’s account was under threat of closure from a Taiwanese hacker known as Chang Chi-Yuan.
In an apparent publicity stunt, the hacker promised his followers, who number in the tens of thousands, that he would publicly delete Zuckerberg’s Facebook account and broadcast the event on Facebook Live.
The deactivation was slated to happen on Sunday at 6 a.m. EST, according to the hacker’s Facebook page. But he later decided to cancel the live feed and report the bug to Facebook instead.
Of these recent cyberattack incidents, the Cambridge Analytica data breach, where 87 million accounts were compromised, stands out as the most devastating.
Zuckerberg saw a sharp drop in trust, appeared before Congress, and was forced to issue an apology in the weeks and months following the breach.
What Should Facebook Users Do Now?
Facebook says there is no need for users to change their passwords after this incident. But, if they want to take an extra security step of logging out of their accounts, they can do so in their settings.
All they have to do is navigate to the “Security and Login” panel and log out of all active sessions, then log back into Facebook as usual.