Facebook estimates the number of EU users affected by hack at up to five million

The Irish privacy watchdog, or the Data Protection Commission Ireland, has revealed that less than 10 percent of users affected by the recent attack on Facebook are EU citizens. That would equate to a maximum of 5 million users.

The privacy watchdog announces the figures from Facebook in a tweet. In it, the organization also writes that Facebook has promised to provide more details about the numbers in the future. earlier said the watchdog waiting for figures from Facebook to map the risk to users and determine the ‘nature of the leak’. In a reaction On the current release from the privacy watchdog, Facebook confirms that it is sharing preliminary data with the organization and that it is working to determine the location of the affected users.

First details about the hack on Facebook came out at the end of last week. Then Facebook said a vulnerability in the View As feature, which allows profiles to be viewed as someone else, gave access to the accounts of nearly 50 million users via access tokens. In addition to the original post, Facebook provided more information about the cause of the incident, stating that it was in fact a combination of three bugs.

In one case, for example, the View As function gave the option of uploading a video, while it should actually be a view-only function. The second bug was related to the video uploader generating an access token when it wasn’t intended to. The third bug was that this token did not belong to the user using the View As function, but to a user that could be chosen by the attackers. Because this token was present in the HTML code on the page, the attackers could use it to log in as that user. They could then repeat this process to loot more tokens.

The European privacy regulation GDPR requires a breach to be reported within 72 hours, a requirement that Facebook appears to have met. The company could still receive a fine of up to 4 percent of its worldwide annual turnover, which would amount to 1.41 billion euros. Whether this will happen is currently unclear.