Facebook: Millions had data stolen in recent hack

Pilfered info includes search history, birth dates, geolocation, addresses

An online attack that forced Facebook to log out 90 million users last month directly affected 29 million people on the social network, the company said Friday as it released new details about the scope of an incident that has regulators and law enforcement on high alert.

Through a series of interrelated bugs in Facebook’s programming, unidentified attackers stole the names and contact information of 15 million users, Facebook said. The contact information included a mix of phone numbers and email addresses.

An additional 14 million users were affected more deeply, having additional details taken related to their profiles, such as their recent search history, gender, educational background, geolocation data, birth dates, and lists of people and pages they follow.

Facebook said last month that it detected the attack when it noticed an uptick in user activity. An investigation soon found that the activity was linked to the theft of security codes that, under normal circumstances, allow Facebook users to navigate away from the site while remaining logged in.

The bugs that allowed the attack to occur gave hackers the ability to effectively take over Facebook accounts on a widespread basis, Facebook said when it disclosed the breach. The attackers began with a relatively small number of accounts that they directly controlled, exploiting flaws in the platform’s “View As” feature to gain access to other users’ profiles. (The “View As” feature is designed to allow users to view their own profiles as though they are somebody else.)

Facebook said it is cooperating with federal and other authorities on its investigation but said the FBI had advised the company not to discuss who may be behind the attack.

What may have motivated the attackers is still unclear; despite mounting concerns about election security as U.S. officials count down to a highly contested midterm election, Facebook said there was no indication the hack was specifically related to the U.S. electoral process.

“We don’t have a specific indication as to the intention of the hackers,” said Guy Rosen, Facebook’s vice president of product management.

Facebook’s disclosure puts the company under even greater pressure as policymakers have taken the company to task over its approach to user privacy and data.