Meta Fined €251M Over 2018 Data Breach Affecting 29M Users

December 18, 2024December 18, 2024

Meta Platforms Fined €251 Million for Major 2018 Data Breach: What You Need to Know

Meta Platforms, the parent company of Facebook, Instagram, WhatsApp, and Threads, has recently faced a hefty fine of €251 million (approximately $263 million) due to a significant 2018 data breach that compromised millions of user accounts. This latest financial penalty underscores Meta’s ongoing challenges in adhering to stringent privacy regulations, particularly within the European Union (EU) and European Economic Area (EEA).

The Irish Data Protection Commission (DPC) reported that the breach affected around 29 million Facebook accounts worldwide, with approximately 3 million of those accounts located within the EU and EEA. Initially, Meta estimated that up to 50 million accounts had been impacted. This breach originated from a bug introduced in July 2017, which allowed unauthorized individuals to exploit the "View As" feature, a function that lets users see their profiles as others would.

Details of the 2018 Data Breach

The data breach involved several critical vulnerabilities that allowed attackers to gain unauthorized access to user accounts. Here’s a breakdown of the key points:

Exploited Vulnerability: Attackers exploited the "View As" feature in conjunction with Facebook’s video uploader and "Happy Birthday Composer," generating access tokens that allowed them to infiltrate multiple accounts.
Personal Data Compromised: The breach resulted in the exposure of various personal information, including users’ full names, email addresses, phone numbers, locations, work details, dates of birth, religion, gender, and even children’s personal data.
Timeline of Events: The malicious activity occurred between September 14 and 28, 2018, ultimately impacting 29 million accounts. Meta has since removed the vulnerable functionality.

Regulatory Violations and Consequences

The DPC’s investigation revealed several violations of the General Data Protection Regulation (GDPR), including:

Inadequate Breach Notification: Meta failed to provide all necessary information during its breach notification.
Insufficient Documentation: The company did not adequately document the breach facts and remediation steps for supervisory authorities.
Privacy by Design: Meta did not ensure that data protection principles were integrated into its processing systems.
Data Minimization Failures: The company did not limit data processing to what was necessary for specific purposes.

Graham Doyle, DPC Deputy Commissioner, emphasized the serious risks to individuals due to these failures, stating that unauthorized exposure of profile information could lead to grave risks of data misuse.

Previous Fines and Ongoing Legal Issues

This recent fine is not an isolated incident for Meta. In September 2024, the company was fined €91 million ($101.5 million) for a separate security issue involving plaintext password storage. Additionally, Meta has agreed to a AU$50 million ($31.5 million) settlement related to the misuse of personal information for political profiling in the wake of the 2018 Cambridge Analytica scandal. This settlement will allow affected Australian users to apply for compensation starting in the second quarter of 2025.

Conclusion

The €251 million fine against Meta Platforms highlights the critical importance of data protection compliance in today’s digital landscape. As regulatory scrutiny intensifies, companies must prioritize user privacy and security.

Are you concerned about data privacy and how companies handle your information? Share your thoughts in the comments below or explore more articles on data protection trends and implications. For further reading, check out the Irish Data Protection Commission and the GDPR official website for more insights.

BadBox Malware Thrives Despite Sinkhole Efforts

December 20, 2024December 20, 2024

The BadBox malware botnet has compromised over 192,000 Android smartphones and smart TVs, raising serious cybersecurity concerns. This surge follows a crackdown by Germany’s Federal Office for Information Security, which previously neutralized 30,000 devices. Recent data indicates over 160,000 unique IP addresses linked to BadBox in a single day, primarily affecting Hisense smartphones and Yandex 4K QLED Smart TVs, with most incidents reported in Russia, China, India, Belarus, Brazil, and Ukraine. Users are urged to update their devices, isolate any affected units, and monitor for unusual activity to mitigate risks associated with this evolving threat.

Deloitte Addresses Ransomware Claims, Confirms Client Impact

December 10, 2024December 10, 2024

Deloitte has responded to claims from the Brain Cipher ransomware group, which alleged a data breach involving over one terabyte of information stolen from its UK branch. Deloitte clarified that only a single client’s system was affected, maintaining that its internal systems are secure. Brain Cipher, notorious for targeting critical sectors, has conducted significant attacks, including a June 2024 strike on Indonesia’s National Data Center. This incident emphasizes the need for robust cybersecurity measures as discrepancies often arise between companies’ assessments and cybercriminals’ exaggerated claims. Organizations must remain vigilant to protect sensitive information and preserve trust with clients.

Cloud Cybersecurity: Key Insights for Businesses – CSP #206

December 24, 2024December 24, 2024

As businesses increasingly adopt cloud technology, cybersecurity becomes crucial. Key lessons for safeguarding sensitive data include encrypting data, enforcing strict access controls, and conducting regular security audits. Organizations must recognize common threats such as data breaches, insider threats, and misconfigurations. To enhance cloud cybersecurity, best practices include implementing multi-factor authentication, providing ongoing employee training, and keeping software updated. Staying informed and proactive is essential for reducing risk exposure and ensuring business continuity in the cloud. For further insights, resources from reputable organizations like the National Institute of Standards and Technology (NIST) can provide valuable guidance.

CISOs: Remember, Mobile Devices Are Endpoints!

January 14, 2025January 14, 2025

The MGM Resorts cyber attack last September, triggered by a fraudulent call to the IT help desk, cost the company over $100 million and highlighted vulnerabilities in mobile device security. Attackers gained access to MGM’s network by impersonating an employee, causing operational chaos. This incident underscores the urgent need for organizations to address mobile security risks, particularly as mobile devices often have broader access to sensitive data. Companies should implement Mobile Device Management (MDM) tools, adopt a zero-trust approach, and update BYOD policies to mitigate these evolving threats and protect valuable information effectively.

EU Privacy Group Sues TikTok, AliExpress Over Data Transfers

January 17, 2025January 17, 2025

Austrian privacy group None of Your Business (noyb) has filed complaints against companies like TikTok, AliExpress, and Xiaomi for allegedly violating EU data protection laws by unlawfully transferring user data to China. Noyb’s lawyer, Kleanthi Sardeli, emphasized that China lacks the data protection standards of the EU, raising concerns about potential government access to sensitive information. The complaints have been lodged in multiple European countries, asserting that these companies do not adequately protect user data. This action comes amid broader scrutiny of data privacy practices, including new FTC regulations in the U.S. aimed at enhancing protections for children’s data.

Biden Prepares Cybersecurity Order After China-Linked Hacks

January 10, 2025January 10, 2025

The Biden administration is set to introduce new cybersecurity regulations aimed at enhancing protections across federal agencies and their contractors. The mandate will enforce robust encryption and authentication protocols to address vulnerabilities in software used by contractors. Recent concerns have been raised regarding software providers failing to fix known vulnerabilities, increasing the risk of cyber attacks. The initiative follows the U.S. Treasury’s sanctions against a Chinese company linked to cyber operations. By emphasizing strong encryption, rigorous authentication, and user training, the administration aims to bolster defenses against evolving cyber threats and establish a solid compliance baseline for organizations.