When Facebook announced at the end of September that it had suffered a data breach[1] that ultimately affected 30 million accounts[2], it seemed, perhaps, like the work of sophisticated nation state hackers. But a new report from The Wall Street Journal[3] suggests spammers as the culprit instead. That shouldn't make you feel that much better, though, given just how much damage criminals can do with the kind of information stolen from Facebook.
It was, after all, a lot. The sophisticated daisy chain attack that the hackers pulled off garnered the names, phone numbers, and email of 15 million Facebook users. Fourteen million more had their username, date of birth, gender, devices they used Facebook on, and language settings compromised at the very least. Hackers could also have gleaned relationship status, religion, hometown, current city, work, and education info, depending on how fully victims had filled out their profile, along with the 10 most recent locations they checked into or were tagged in, and their 15 most recent Facebook searches. (Here's how to find out if you were affected, and how badly[4].)
All of which becomes particularly dangerous in the hands of spammers.
"Having accurate, detailed data, and a large amount of data, makes spamming campaigns more profitable," says Jérôme Segura, lead malware intelligence analyst at the network defense firm Malwarebytes. "And this Facebook data is very unique. It has a lot of value, because it's from people supplying the information genuinely and saying 'I checked in at this hotel or here are some of my interests.' It's a priceless database trove for marketers."
For now, Facebook won't weigh in publicly on who was behind the attack. Guy Rosen, the social network's vice president of product management