Facebook's Alleged New Data Breach: 120 Million Accounts Claimed to Be Compromised

Facebook is back in the limelight with another alleged data breach, and this time users' personal messages shared on the platform are claimed to have been compromised. A report by BBC cites the perpetrators themselves to say almost 81,000 users' personal messages are published and compromised on the Internet, and hackers are looking to make money from it. The hackers allege that they have personal data of over 120 million Facebook account holders, and they are looking to sell it at $0.10 per account. Facebook claims that its service didn't suffer any breach, and asserts that this data has been obtained by the hackers via malicious extensions.

The report states that most of the accounts that have been compromised are based in Ukraine and Russia, but some accounts are from UK, US, and Brazil as well. The advertisement listed online said that full access to personal messages can be obtained at $0.10 per account, and it listed 81,000 of the profiles as samples for buyers. This advertisement has since been removed. Compromised data reportedly included chats about a recent Depeche Mode concert, complaints about a son-in-law, intimate conversations between lovers, and photos of a recent holiday as well. BBC posed as potential buyers of this data, and uncovered that these hackers were not linked to the Russian state or to the Internet Research Agency - a group of hackers linked to the Kremlin.

The publication also cited Digital Shadows to claim that 120 million was an unlikely figure for the number of victims, as Facebook would not have missed such a large breach. Digital Shadows was also able to confirm that over 81,000 profiles in the sample contained private messages, and the BBC Russian Service further contacted five of the victims to confirm the posts were indeed theirs.

Facebook maintains that its services haven't suffered any security breach, but this data has been obtained via malicious extensions. "We have contacted browser-makers to ensure that known malicious extensions are no longer available to download in their stores. We have also contacted law enforcement and have worked with local authorities to remove the website that displayed information from Facebook accounts," Facebook executive Guy Rosen told the publication.

Without naming the extensions, Facebook explains that these malicious extensions quietly monitored users' activity, and sent data back to the hackers, without the users' knowledge. It maintains that this particular data breach was not its fault, and urged browser-makers to exercise more caution. Upon further investigation, BBC learned that the new data breach was not linked with the Cambridge Analytica scandal or the recent data breach in September.

Users are advised to exercise caution while downloading extensions, and only use and download those that are offered by official and legit companies.