Breachesby GlyphDisclosed Sep 28, 201829,000,000 affectedSettled
2018 View As token theft hit 29M Facebook accounts; Irish DPC fines of EUR 251M
Attackers exploited Facebook's View As feature to steal user access tokens in September 2018; Facebook first said 50 million accounts were at risk and the DPC later put the impact at about 29 million accounts, 3 million in the EU/EEA. The DPC fined Meta EUR 251M in total over the breach and its notification.
What is known
| People affected | 29,000,000 (as reported by the organization) |
|---|---|
| Disclosed | Sep 28, 2018 |
| Discovered | Sep 25, 2018 |
| Attack | Hacking |
| Data exposed | NamesEmailsPhone numbersOtherLocationEmploymentDates of birthChildren's data |
| Sector | Tech · US |
| Status | Settled |
| Lawsuit or fine | EUR 251M Irish DPC fines (Dec 2024) (about $263M) |
Sources
Notices filed
Other breaches at Facebook
Hacking breachHacking exposed emails, location data, names, passwords and phone numbers.77K accountsTechUnverifiedFeb 22, 2024Twelve 2018 Facebook breach notifications; Irish DPC fine of EUR 17MTechUSMar 15, 2022Scraped dataset of 533M Facebook users posted online; Irish DPC fine of EUR 265MScraping exposed dates of birth, emails, employment records, location data, names and phone numbers.Scraping533M affectedTechUSApr 3, 2021Exposed server holds 419 million records linking Facebook IDs to phone numbersScraping exposed phone numbers.ScrapingTechUSUnverifiedSep 4, 2019Hundreds of millions of passwords stored in plaintext; Irish DPC fine of EUR 91MExposed data exposed passwords.Exposed dataTechUSMar 21, 2019Data of up to 87 million Facebook users improperly shared with Cambridge AnalyticaVendor breach exposed names and location data.Vendor breach87M affectedTechUSMar 17, 2018
History of this record
confirmed to settledby seedSource
empty to 263000000by seedSource
empty to EUR 251M Irish DPC fines (Dec 2024)by seedSource
["names","emails","phone","other"] to ["names","emails","phone","other","location","employment","dob","children"]by seedSource
Facebook said attackers exploited a flaw in its View As feature to steal access tokens; it first said almost 50 million accounts were affected and later reported that profile information from about 29 million accounts was accessed. to Attackers exploited Facebook's View As feature to steal user access tokens in September 2018; Facebook first said 50 million accounts were at risk and the DPC later put the impact at about 29 million accounts, 3 million in the EU/EEA. The Dby seedSource
View As bug lets attackers steal access tokens, exposing 29 million accounts to 2018 View As token theft hit 29M Facebook accounts; Irish DPC fines of EUR 251Mby seedSource
empty to 50000000by seedSource
First recordedby seedSource
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.