Criminals offer Facebook user data for sale on Internet forums. A sample of 81,000 profiles showed that private messages are available, among other things. The sellers claim that they have data from a total of 120 million accounts.
This mainly involved data from Ukrainian and Russian users, and to a lesser extent from accounts from the UK, US, Brazil and other countries. The BBC Russia Service investigated the offer, which came to light in September, in partnership with security firm Digital Shadows.
The file the criminals released to support their claim was found to contain private messages from more than 81,000 accounts. E-mail addresses and telephone numbers were present for another 176,000 accounts. According to Digital Shadows, the latter data can simply be scraped from profiles that do not shield data.
The rest of the data is most likely obtained through malicious browser extensions. Facebook reports to the BBC that it is not suffering from a security incident, but is aware of a browser extension that transfers data. That makes the criminals’ claim that they have a database of 120 million Facebook profiles unlikely, according to Digital Shadows. Facebook should have noticed a data breach of that magnitude.
Facebook was recently hit by a data breach that gave criminals access to millions of access tokens. It also fell into disrepute earlier this year after Cambridge Analytica passed on account data for election purposes. The seller told the BBC that his offer has nothing to do with this.