Disclosed Sep 28, 20187 years ago29,000,000 affectedSettled
2018 View As token theft hit 29M Facebook accounts; Irish DPC fines of EUR 251M
Attackers exploited Facebook's View As feature to steal user access tokens in September 2018; Facebook first said 50 million accounts were at risk and the DPC later put the impact at about 29 million accounts, 3 million in the EU/EEA. The DPC fined Meta EUR 251M in total over the breach and its notification.
What is known
| People affected | 29,000,000 (as reported by the organization) |
|---|---|
| Disclosed | Sep 28, 2018 |
| Discovered | Sep 25, 2018 |
| Attack | Hacking |
| Data exposed | Names, Emails, Phone numbers, Other, Location, Employment, Dates of birth, Children's data |
| Sector | Tech · US |
| Status | Settled |
| Lawsuit or fine | EUR 251M Irish DPC fines (Dec 2024) (about $263M) |
Sources
| Source | |
|---|---|
| Security Updateabout.fb.com · The organization | The organization |
| Facebook 10-Q for Q3 2018sec.gov · SEC filing | SEC filing |
| Facebook says at least 50 million users affected by security breachtechcrunch.com · News | News |
| Facebook breach hit up to 5M EU userstechcrunch.com · News | News |
| Irish Data Protection Commission fines Meta EUR 251 Milliondataprotection.ie · Regulator | Regulator |
Notices filed
Other breaches at Facebook
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Feb 22, 2024Feb 22, 20242 years agoHackingUnverified | Feb 22, 20242 years ago | Hacking | Tech | Unverified | 77Kacct |
| Twelve 2018 Facebook breach notifications; Irish DPC fine of EUR 17MMar 15, 20224 years ago | Mar 15, 20224 years ago | Not stated | Tech | Settled | Unknown |
| Scraped dataset of 533M Facebook users posted online; Irish DPC fine of EUR 265MApr 3, 20215 years agoScraping | Apr 3, 20215 years ago | Scraping | Tech | Settled | 533M |
| Exposed server holds 419 million records linking Facebook IDs to phone numbersSep 4, 20197 years agoScrapingUnverified | Sep 4, 20197 years ago | Scraping | Tech | Unverified | Unknown |
| Hundreds of millions of passwords stored in plaintext; Irish DPC fine of EUR 91MMar 21, 20197 years agoExposed data | Mar 21, 20197 years ago | Exposed data | Tech | Settled | Unknown |
| Data of up to 87 million Facebook users improperly shared with Cambridge AnalyticaMar 17, 20188 years agoVendor breach | Mar 17, 20188 years ago | Vendor breach | Tech | Settled | 87M |
History of this record
- 2026-09-25 · status: confirmed to settled · seed source
- 2026-09-25 · fine_usd: empty to 263000000 · seed source
- 2026-09-25 · lawsuit: empty to EUR 251M Irish DPC fines (Dec 2024) · seed source
- 2026-09-25 · data_types: ["names","emails","phone","other"] to ["names","emails","phone","other","location","employment","dob","children"] · seed source
- 2026-09-25 · summary: Facebook said attackers exploited a flaw in its View As feature to steal access tokens; it first said almost 50 million accounts were affected and later reported that profile information from about 29 million accounts was accessed. to Attackers exploited Facebook's View As feature to steal user access tokens in September 2018; Facebook first said 50 million accounts were at risk and the DPC later put the impact at about 29 million accounts, 3 million in the EU/EEA. The D · seed source
- 2026-09-25 · title: View As bug lets attackers steal access tokens, exposing 29 million accounts to 2018 View As token theft hit 29M Facebook accounts; Irish DPC fines of EUR 251M · seed source
- 2026-09-25 · records: empty to 50000000 · seed source
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.