Facebook Stored Hundreds of Millions Passwords in Plain Text, Thousands of Employees Had Access

Facebook today announced that during a routine security review it discovered "some user passwords" were stored in a readable format within its internal data storage systems, accessible by employees.

As it turns out, "some user passwords" actually means hundreds of millions of passwords. A Facebook insider told KrebsOnSecurity that between 200 and 600 million Facebook users may have had their account passwords stored in plain text in a database accessible to 20,000 Facebook employees. Some Instagram passwords were also included, and Facebook claims many of the passwords came from Facebook Lite users.

Facebook says that there's no "evidence to date" that anyone within Facebook abused or improperly accessed the passwords, but KrebsOnSecurity's source says 2,000 engineers or developers made around nine million internal queries for data elements that contained plain text user passwords.

Facebook employees reportedly built applications that logged unencrypted password data, which is how the passwords were exposed. Facebook hasn't determined exactly how many passwords were stored in plain text, nor how long they were visible.

Facebook plans to notify users whose passwords were improperly stored, and the company says that it has been looking at the ways certain categories of information, such as access tokens, are stored, and correcting problems as they're found.

"There is nothing more important to us than protecting people's information, and we will continue making improvements as part of our ongoing security efforts at Facebook," reads Facebook's blog post.

Facebook and Instagram users who are concerned about their account security should change their passwords, using unique passwords that are different from passwords used on other sites. Facebook also recommends users enable two-factor authentication.

Top Rated Comments

(View all)

11 months ago
Delete Facebook and delete your accounts
Rating: 104 Votes
11 months ago
How is this company not being criminally prosecuted?
Rating: 84 Votes
11 months ago
While many are saying "is anyone surprised" I actually am at this.

This is one of the largest corporations in the world, whose sole business is its internet applications, and they ignored one of the most basic security expectations of hashing a password?

That is absolutely surprising and shameful and there is no excuse from them that is acceptable.
Rating: 47 Votes
11 months ago
Consider my mind blown.

Rating: 35 Votes
11 months ago
I'm shocked at Facebook's lack of security!
Said nobody.
Rating: 34 Votes
11 months ago

Use privacy enhancing tech or pay the price, in future privacy will be currency.

* Veracrypt
* Monero
* DuckDuckGo
* Pi.hole
Rating: 31 Votes
11 months ago
Every turd knows you salt the password and hash it and never ever store anything other than the hash. The password should never even have been transmitted to Facebook, but that’s a whole other story.

These guys should be shut down.
Rating: 20 Votes
11 months ago
I dont feel bad for Zuckerberg for a second over the autobahn speed dumpster fire car crash that is Facebook that none of us can look away from.

Karma is so frigging beautiful. And to think, the demise of Zuck/FB is only in its earliest phase. Popcorn.gif

Good luck with that new privacy-centric platform pitch too, credible Lizardman! ;)

He'll be lucky to go the way of Tom; irrelevant. In more likelihood, jail time and litigation issues / scandals piling up until his old age. He certainly will not have gotten the last laugh, proverbially speaking.

I think in the end, Tom wasn't just everyone's friend on MySpace, he was indirectly everyone's friend IRL.

The platform caving on itself was a great 'avante-garde' gift to humanity; Nobel Peace Prize worthy imo!

And while I engage in debate often in polarizing pol threads, I think we *all* can rally behind the fact both sides are equally furious (for different reasons) at Facebook... Maybe thats the sort of common ground unity we need?
Rating: 14 Votes
11 months ago
Is anyone surprised at this point?
Rating: 14 Votes
11 months ago
Almost as bad as MacOS no root password.
Rating: 12 Votes

[ Read All Comments ]