Facebook Data Breach Exposes 509 Million User Records
What Happened — In April 2021 a dataset containing personal information for over 509 million Facebook accounts was posted publicly. The data set, representing roughly 20 % of Facebook’s user base, included names, phone numbers, dates of birth, locations, relationship status, employer details and other identifiers. The breach is attributed to a vulnerability that Facebook disclosed it had patched in August 2019.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of un‑remediated vulnerabilities in large‑scale platforms and the need for continuous vulnerability‑management evidence.
- Highlights the importance of maintaining a defensible audit trail that shows timely detection, remediation, and verification of security controls.
- Aligns with the control objective of system security monitoring and remediation, a single control that maps to many frameworks (e.g., NIST CSF, ISO 27001, SOC 2).
Who Is Affected – Social media platforms, digital advertising ecosystems, and any organization that integrates Facebook login or data APIs.
Recommended Actions
- Review and tighten your vulnerability‑management process: ensure patches are applied within defined SLAs and documented in a central repository.
- Collect and retain evidence of remediation activities (ticketing logs, patch deployment records) to support audit readiness.
- Update incident‑response playbooks to include data‑exfiltration scenarios involving third‑party platforms.
Source: Have I Been Pwned – Facebook breach
Technical Notes – The breach leveraged a previously disclosed vulnerability (patched Aug 2019). No CVE is publicly referenced. Exposed data types: names, phone numbers, emails (2.5 M records), dates of birth, gender, location, relationship status, employer.