Earlier today, Facebook announced on blog that hackers had gained access to login tokens from around 50 million users. 
It should be noted that the first lawsuit has already been filed accusing the company of its apparent failure to protect its users' data.
But was any data other than login tokens leaked?
Despite the blog post informing us of the breach and the interception of login tokens, Facebook has not provided any further details about the hack.
Who could be responsible? Was user data leaked? Why does the company believe that only login tokens from 50 million accounts were leaked? In addition, the company stated that another 40 million accounts (friends of the 50 million accounts that were leaked) may be affected, without stating how it came to this conclusion.
According to Facebook engineers, the social network made a code change in July 2017 to the “View as” feature. The exploit was reportedly first activated on September 16. So September 16 is the day that Facebook believes hackers began to massively exploit this flaw to gain access to the “View as” feature and obtain access tokens for the company’s users’ accounts.
The access token collection feature caused massive traffic to Facebook’s servers. and Facebook engineers realized what was happening on September 26. They began investigating it on September 27, and announced their findings this morning.
All of the above was published by the company and there seems to be a gap between September 16 and the 28th when the token leak was published.
The size of a company like Facebook does not allow for the disclosure of an incident that affects so many millions of users after so many days.
Of course, the company, as it has stated on its blog, took so many days to identify the vulnerability. But once again, the size of a company like Facebook does not allow for the disclosure of an incident that affects so many millions of users after so many days.
For about 12 days, hackers were able to connect to user accounts, and collect all their personal data. So the first complaint to the company is not a surprise. We should probably expect more.
class actions against facebook by on Scribd
___________________________
