Uiggy Facebook App Breach Exposes 2.68 M User Accounts
What Happened — In June 2016 the third‑party Facebook application “Uiggy” was compromised. Attackers accessed the app’s data store and extracted 2,682,650 user records, including email addresses, names, genders, social connections and website activity.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient third‑party oversight: a compromised app can become a conduit for large‑scale personal data loss.
- Highlights the need for continuous monitoring of vendor security posture and evidence of due‑diligence to satisfy audit requirements.
- Provides a concrete example of why a control‑assurance program must capture and retain proof of vendor risk assessments and remediation actions.
Who Is Affected – Social‑media platforms, SaaS providers that host third‑party applications, and any organization that integrates external apps into its user ecosystem.
Recommended Actions
- Inventory all third‑party applications that have access to user data and classify them by risk.
- Verify that each vendor maintains a documented security program and undergoes regular independent assessments.
- Implement continuous monitoring of vendor security alerts (e.g., HIBP, CISA) and integrate findings into your risk register.
Technical Notes – The breach stemmed from a compromise of the Uiggy app’s authentication/authorization logic, allowing attackers to pull user profile data via Facebook’s Graph API. No specific CVE was disclosed. Data types exposed: email addresses, names, genders, social connections, and website activity. Source: https://haveibeenpwned.com/api/v3/breach/Uiggy