Facebook last week said a security breach gave hackers access to 50 million user accounts and the private information stored in them, and also exposed their accounts with other online services such as Instagram, Spotify, Tinder and Airbnb to unauthorized use because they logged into these services using their Facebook accounts.
The breach is a security and privacy nightmare that affected even Facebook Chief Executive Mark Zuckerberg and Chief Operating Officer Sheryl Sandberg, whose accounts were also compromised.
Over the weekend, the National Privacy Commission said it was still determining how many Filipino users of the social networking site were affected by the massive data breach.
In a statement, NPC Commissioner Raymund Liboro said that Facebook representatives report that the investigation is still in its early stages. “They have not determined yet how many Filipinos are affected and whether misuse of personal information had resulted from this breach,” Liboro said.
If usage patterns are any indications, this will likely run into the millions. Statista, the statistics portal, ranks the Philippines as the sixth largest user of Facebook (behind India, the United States, Brazil, Indonesia and Mexico), with 70 million users as of July 2018.
Zuckerberg said the company is investigating the extent of harm done when hackers exploited software flaws to steal “access tokens,” the equivalent of digital keys that enable people to automatically log back into the social network.
Zuckerberg said engineers discovered the breach on Tuesday, and patched it on Thursday night.
“We don’t know if any accounts were actually misused,” Zuckerberg said. “This is a serious issue.”
“We’ve fixed the vulnerability and informed law enforcement.”
Facebook reset the 50 million breached accounts, meaning users will need to sign back in using passwords—but none of this is a guarantee against new breaches in the future.
It is also unclear what the hackers planned to do with the access they obtained to 50 million user accounts.
Social media accounts are hacked for a variety of reasons—to force shares, to force follows or to steal private information that hackers can use to sign into other accounts with banks and online retailers.
The NPC correctly puts some of the responsibility for protecting private information on users themselves.
“To protect themselves, all Facebook users must enable multi-factor authentication on all platforms, employ strong passwords, and practice good digital hygiene,” Liboro said.
These are common sense precautions to take when a person decides to put private information that could be misused by malicious third parties onto a shared network. It would also make sense to limit the amount of personal information we post online, since safeguards against unauthorized access are far from fool-proof. But sadly, common sense isn’t all that common when it comes to social media use.
