Breach Disclosure: Facebook

On April 3, 2021, ZeroFOX observed the RaidForums actor "TomLiner" post a 15 GB database of 533,313,128 user records split into 106 country-specific download files scraped from Facebook (facebook.com). The large majority of records list phone numbers associated with Facebook accounts, while a smaller slice contains other personally identifiable information (PII) such as name, email address, gender, date of birth, occupation, city, country, biography, and relationship status. The database does not contain any passwords.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

A Facebook spokesperson noted that the data was originally compiled by exploiting a contact importer vulnerability patched in late August 2019 that made it "possible to input multiple phone numbers and, by running an algorithm, connect which number matched to a specific user." In 2020, the RaidForums actors "GreenHat77" and "Yusuf234567" each offered the same database for sale, the latter of whom completed multiple transactions with positive feedback into early 2021.

Some observers speculate that these users are aliases of the RaidForums actor "seller13" who is openly affiliated with the hacking group "ShinyHunters". Another actor under the alias "omgdata" a.k.a. "osintshopmanager" also monetized querying the database through a Telegram bot in January. From this data breach package, ZeroFOX extracted 46,343,480 unique records with email addresses, including 44,318,402 with facebook[.]com domains (username[@]facebook[.]com) and 2,025,78 with other email domains (primarily gmail[.]com, hotmail[.]com, and yahoo[.]com).