Disclosed Apr 3, 20215 years ago533,000,000 affectedSettled
Scraped dataset of 533M Facebook users posted online; Irish DPC fine of EUR 265M
A dataset of phone numbers, Facebook IDs, names, locations, birth dates and some emails covering over 533 million users was posted on a hacking forum in April 2021; Facebook said it came from scraping via contact importer features. Ireland's DPC found Article 25 data protection by design failures and fined Meta EUR 265M.
What is known
| People affected | 533,000,000 (as reported by the organization) |
|---|---|
| Disclosed | Apr 3, 2021 |
| Happened | Aug 1, 2019 |
| Attack | Scraping |
| Data exposed | Dates of birth, Emails, Employment, Location, Names, Phone numbers |
| Sector | Tech · US |
| Status | Settled |
| Lawsuit or fine | EUR 265M Irish DPC fine (Nov 2022) (about $275M) |
| Check your email | Have I Been Pwned |
Sources
| Source | |
|---|---|
| Have I Been Pwned: Facebookhaveibeenpwned.com · Aggregator | Aggregator |
| The Facts on News Reports About Facebook Dataabout.fb.com · The organization | The organization |
| Answers being sought from Facebook over latest data breachtechcrunch.com · News | News |
| DPC announces decision in Facebook Data Scraping Inquirydataprotection.ie · Regulator | Regulator |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Apr 3, 2021 | 533,000,000 |
| Researchtotal | Apr 3, 2021 | |
| Have I Been Pwnedaccounts in the data | Apr 4, 2021 | 509,458,528 |
Other breaches at Facebook
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Feb 22, 2024Feb 22, 20242 years agoHackingUnverified | Feb 22, 20242 years ago | Hacking | Tech | Unverified | 77Kacct |
| Twelve 2018 Facebook breach notifications; Irish DPC fine of EUR 17MMar 15, 20224 years ago | Mar 15, 20224 years ago | Not stated | Tech | Settled | Unknown |
| Exposed server holds 419 million records linking Facebook IDs to phone numbersSep 4, 20197 years agoScrapingUnverified | Sep 4, 20197 years ago | Scraping | Tech | Unverified | Unknown |
| Hundreds of millions of passwords stored in plaintext; Irish DPC fine of EUR 91MMar 21, 20197 years agoExposed data | Mar 21, 20197 years ago | Exposed data | Tech | Settled | Unknown |
| 2018 View As token theft hit 29M Facebook accounts; Irish DPC fines of EUR 251MSep 28, 20187 years agoHacking | Sep 28, 20187 years ago | Hacking | Tech | Settled | 29M |
| Data of up to 87 million Facebook users improperly shared with Cambridge AnalyticaMar 17, 20188 years agoVendor breach | Mar 17, 20188 years ago | Vendor breach | Tech | Settled | 87M |
History of this record
- 2026-09-25 · status: confirmed to settled · seed source
- 2026-09-25 · fine_usd: empty to 275000000 · seed source
- 2026-09-25 · lawsuit: empty to EUR 265M Irish DPC fine (Nov 2022) · seed source
- 2026-09-25 · summary: Data on more than 530 million Facebook users, mainly phone numbers linked to profiles, was published online; Facebook said it was scraped via its contact importer before September 2019. to A dataset of phone numbers, Facebook IDs, names, locations, birth dates and some emails covering over 533 million users was posted on a hacking forum in April 2021; Facebook said it came from scraping via contact importer features. Ireland' · seed source
- 2026-09-25 · title: Scraped data of 533 million Facebook users posted free online to Scraped dataset of 533M Facebook users posted online; Irish DPC fine of EUR 265M · seed source
- 2026-09-25 · source_type: aggregator to company · seed source
- 2026-09-25 · source_url: https://haveibeenpwned.com/Breach/Facebook to https://about.fb.com/news/2021/04/facts-on-news-reports-about-facebook-data/ · seed source
- 2026-09-25 · status: disclosed to confirmed · seed source
- 2026-09-25 · verified_by: empty to research · seed source
- 2026-09-25 · verified: 0 to 1 · seed source
- 2026-09-25 · country: empty to US · seed source
- 2026-09-25 · attack: unknown to scraping · seed source
- 2026-09-25 · records_basis: hibp to organization · seed source
- 2026-09-25 · records: 509458528 to 533000000 · seed source
- 2026-09-25 · disclosed: 2021-04-04 to 2021-04-03 · seed source
- 2026-09-25 · summary: In April 2021, a large data set of over 500 million Facebook users was made freely available for download . Encompassing approximately 20% of Facebook's subscribers, the data was allegedly obtained by exploiting a vulnerability Facebook adv to Data on more than 530 million Facebook users, mainly phone numbers linked to profiles, was published online; Facebook said it was scraped via its contact importer before September 2019. · seed source
- 2026-09-25 · title: empty to Scraped data of 533 million Facebook users posted free online · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Have I Been Pwned), confirmed by Research. Record counts are as reported. Not legal advice.