Motherboard has revealed that someone has gained access to a database containing Facebook users’ phone numbers and is now selling that data through a Telegram bot. Alon Gal – the security researcher who discovered the incident – reports that the person running the bot claims to have the information of 533 million users. The person also said that he exploited a vulnerability in Facebook, which was patched in 2019.
In many databases, some technical skill is required to find useful data. Additionally, there usually needs to be interaction between the person who owns the database and the person trying to steal information from it, as the “owner” of the database is not going to just give someone else all that valuable data. Creating a Telegram bot, however, solves both of these issues.
The bot allows someone to do two things:
- if he has the Facebook user ID , he can find that person's phone number
- if he has a person's phone number he can find their Facebook user ID
Accessing of information, like a phone number or a Facebook ID, comes at a cost, as the person behind the bot sells it for $20.
It’s worth noting that the bot has been operating since at least January 12, 2021, according to screenshots posted by Gal. However, the data it provides access to is from 2019. So it’s relatively old data, but people don’t change phone numbers often. As is known, Facebook collects phone numbers from people, including users who enable two-factor authentication (2FA).
It is not known at this time whether Motherboard researchers or other security researchers have contacted Telegram to try to shut down the bot, but the researchers hope to quickly stop the easy access and offering of stolen data online.
