Attaullah Baig, the former head of security at WhatsApp, has filed a lawsuit against Meta and its executives, accusing them of failing to address critical cybersecurity vulnerabilities and retaliating against him when he tried to fix them. The case has caused a stir in the tech world, as it highlights serious issues about data security and vulnerability management by major tech companies.
According to the lawsuit, Meta failed to address serious security vulnerabilities identified in WhatsApp's platform, putting users' safety at risk. Baig, who had taken responsibility for the platform's security, claims that his concerns were ignored and that he faced retaliation when he tried to highlight the problems.
See also: New WhatsApp scam gains access to your conversations
Security gaps in WhatsApp
The lawsuit details the vulnerabilities identified and Baig's efforts to inform Meta's management. Baig claims that his efforts to improve the platform's security were hindered by the company's leadership, which allegedly put profit above user safety.
The former employee is said to have discovered that hundreds of engineers had unrestricted data WhatsApp user. He also claims that the company failed to address a significant volume of account takeovers.
Meta is also accused of violating an order requiring it to monitor access to user data, as well as failing to disclose the issues to the Securities and Exchange Commission (SEC).
Baig joined WhatsApp in 2021 and served as its chief security officer until he was fired in February 2025 for poor performance. Before WhatsApp, he held cybersecurity roles at PayPal and Capital One. He says pressure on leadership to address vulnerabilities led to negative performance reviews against him and the cancellation of security features his team had developed.
See also: WhatsApp urgent update for iOS and macOS apps
Baig was eventually fired a few months after he personally reported Meta's alleged shortcomings to the Securities and Exchange Commission (SEC).
The lawsuit names Zuckerberg. It also names several other executives, including WhatsApp Vice President and Head of Engineering Will Cathcart, WhatsApp Chief Engineering Officer Nitin Gupta, and Pinaki Mukerji and Mark Tsimelzon, former and current directors of engineering at WhatsApp.
Andy Stone, Meta's communications director, responded to the lawsuit in a message posted on X, saying: "Unfortunately, this is a familiar scenario where a former employee is fired for poor performance and then goes public with distorted claims that misrepresent the ongoing hard work of our team."
The case comes at a critical time for Meta, which is already under pressure from previous data breaches and concerns about user privacy. Baig's lawsuit could have serious consequences for Meta's reputation and affect the company's security strategy.
The lawsuit also highlights the issue of vulnerability management by major tech companies and the importance of transparency and accountability in cybersecurity. Experts say Baig's case could set a precedent for other industry professionals facing similar problems.
See also: CISA: New TP-Link and WhatsApp vulnerabilities in the KEV Catalog
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Judging by Mr. Stone's comment, Meta is expected to defend its practices. The development of the case will be closely watched by the tech community, as it could affect how companies manage vulnerabilities and protect their users' data.
Baig's case is a reminder of the importance of cybersecurity and the need for technology companies to continually improve their security practices. As cyber threats continue to evolve, ensuring the security of user data should be a priority for all companies in the industry.
