Facebook Confirms Millions of Instagram Passwords Were Stored in Plain Text

Back in March, Facebook announced that millions of Facebook passwords were stored on its servers in plain text with no encryption. At the time, Facebook also said that "tens of thousands" of Instagram passwords were also stored in the same unencrypted format, but as it turns out, the actual number was much, much higher.

In an update to its original blog post, Facebook now says that millions of Instagram passwords were stored on its servers in a readable format.

Update on April 18, 2019 at 7AM PT: Since this post was published, we discovered additional logs of Instagram passwords being stored in a readable format. We now estimate that this issue impacted millions of Instagram users. We will be notifying these users as we did the others. Our investigation has determined that these stored passwords were not internally abused or improperly accessed.
These unencrypted, plain text passwords were accessible to thousands of Facebook employees, and while Facebook says that there's no "evidence to date" that anyone within Facebook abused or improperly accessed the passwords, it's highly concerning.

Instagram user names, unlike Facebook usernames, can be highly appealing to thieves. Short names can sell for quite a lot of money, which makes Instagram passwords rather valuable.

Facebook was not forthcoming about the discovery of additional impacted Instagram accounts, burying it in a month-old blog post and, as Recode points out, releasing the update just before the Mueller report came out and media sites were distracted.

Facebook will be notifying Instagram users whose passwords were improperly stored, and Instagram users who are concerned about their accounts should change their passwords and make sure two-factor authentication is enabled.

Facebook's latest security leak comes just a day after news spread that Facebook harvested the email contacts of 1.5 million Facebook users without their consent and used the data to build a web of social connections.

Earlier this week, a scathing report also outlined how Facebook leveraged user data to punish its rivals and reward companies who paid heavily into Facebook advertising and shared data of their own.

Top Rated Comments

(View all)

8 months ago
I'm waiting for this one:

"We accidentally sold your personal data, including our records of where in your home you keep your valuables and what time you leave the house, to an association of professional thieves. We've now corrected our procedures and promise not to do this again, at least not very often."
Rating: 32 Votes
8 months ago
And people are still trusting and using Facebook, why again?
Rating: 27 Votes
8 months ago
It's sad this isn't shocking news anymore.
Rating: 20 Votes
8 months ago
Every week/month we find out that either email or social media outlets are shockingly careless when it comes to the data of the user. At the most a multi-billion dollar entity gets hit with a fine that is like them handing out a $20. Maybe we should all stop using their services and see how they are affected? Nobody NEEDS FB.
Rating: 15 Votes
8 months ago
I am surprised the EU is staying so quiet about this whole mess.

Lobbying is a hell of a thing I guess
Rating: 12 Votes
8 months ago
And I see people on here moan about Amazon’s apparent invasion on privacy, how they don’t dare ever own an Echo.. and then they go and use Facebook :rolleyes: Utter hypocrites!

Remember folks, Zuckerbeg would literally sell YOUR soul if he could get it, for cash...

The writing was on the wall about this years and years ago. Plenty of reports about Facebooks complete disgregard for security and privacy going back a way.
Rating: 11 Votes
8 months ago

I understand Facebook has made many mistakes, but lately the media seems to be trying so hard to destroy Facebook.

A mistake is not something FB makes. They didn't mistakenly sell personal data of millions of users.
This is not some start-up with a sleepy admin at the wheel .
They are a criminals. Plain and simple .
Rating: 10 Votes
8 months ago
You're better off assuming that all of your credentials have been compromised, or could easily be compromised. Use multi-factor whenever possible
Rating: 10 Votes
8 months ago

I understand Facebook has made many mistakes, but lately the media seems to be trying so hard to destroy Facebook.


And for the right reasons, the better of mankind.
Rating: 9 Votes
8 months ago
It’s almost comical how ****** of a company Facebook is. And Zuckerberg should be in prison.
Rating: 8 Votes

[ Read All Comments ]