The breach, caused by a combination of flawed platform features, allowed attackers to access usernames, contact information, and other sensitive information and reports. 24 Channels with reference TechCrunch.

What happened?

The roots of the problem date back to 2017, when Facebook introduced the “View As” feature that allowed users to see how their profile appeared to others. However, this feature accidentally interacted with the “Happy Birthday Composer” tool, causing a security vulnerability in Facebook’s system. Taking advantage of this flaw, attackers were able to create tokens that gave access to other users’ profiles.

Sensitive data included users’ full names, phone numbers, email addresses, dates of birth, information about their place of employment, gender, religious beliefs and even information about their children. Facebook groups, news feed messages and personal data related to location were also compromised.

Violations and fines

The DPC identified two significant GDPR breaches in the way Meta responded to the incident.

• firstThe company did not provide the regulator with complete documentation of the incident, including the facts surrounding the breach and the measures taken to remedy it.
• SecondThe DPC found that Meta did not provide adequate protection for user data.

These violations resulted in two fines: 11 million euros not disclosing all information and 240 million euros Due to insufficient protection of users’ personal data.

Meta’s reaction

As Meta responded to the court ruling, company spokesperson Emily Westcott told TechCrunch:

This decision relates to an incident that occurred in 2018. We took immediate action to rectify the issue as soon as we became aware of it and notified those affected and the Irish Data Protection Commission in advance. We have a wide range of industry-leading measures in place to protect people on our platforms.

This isn’t the first major fine Meta has faced from the DPC (and likely won’t be the last). The company was fined in September 2024 91 million euros in 2019 for publicly storing “hundreds of millions” of user passwords on its servers.