Facebook Marketplace – 77,267 User Accounts Exposed via Contractor Leak
What Happened — In February 2024 a data set of roughly 200 k Facebook Marketplace records, originally taken from a Meta‑contracted service in October 2023, appeared on a public hacking forum. The dump contained 77 267 unique email addresses, names, phone numbers, profile IDs, geographic locations and bcrypt password hashes.
Why It Matters for Trust & Control Assurance
- The incident illustrates a classic supply‑chain control gap: a third‑party contractor accessed or stored privileged user data without sufficient oversight.
- Continuous third‑party risk monitoring and documented due‑diligence evidence are the exact controls a trust‑and‑assurance program expects to have in place to detect, prevent, and prove remediation of such exposures.
- Demonstrating a defensible audit trail for vendor oversight aligns with the Vendor Risk Management capability in Verisq’s portfolio.
Who Is Affected – Social‑media platforms, online marketplaces, and any organization that outsources user‑data handling to contractors (technology/SaaS sector).
Recommended Actions
- Review and tighten contracts to require explicit data‑handling controls and right‑to‑audit clauses.
- Deploy continuous monitoring of third‑party access logs and enforce least‑privilege principles for contractor accounts.
- Collect and retain evidence of vendor assessments to satisfy audit readiness for frameworks such as NIST CSF 2.0. Source: https://haveibeenpwned.com/api/v3/breach/FacebookMarketplace
Technical Notes
- Attack vector: unauthorized data extraction by a contractor (third‑party dependency).
- Exposed data types: email addresses, names, phone numbers, geographic locations, Facebook profile IDs, bcrypt password hashes (no confirmed link to active accounts). Source: https://haveibeenpwned.com/api/v3/breach/FacebookMarketplace