Breachesby GlyphDisclosed Apr 3, 2021533,000,000 affectedSettled
Scraped dataset of 533M Facebook users posted online; Irish DPC fine of EUR 265M
A dataset of phone numbers, Facebook IDs, names, locations, birth dates and some emails covering over 533 million users was posted on a hacking forum in April 2021; Facebook said it came from scraping via contact importer features. Ireland's DPC found Article 25 data protection by design failures and fined Meta EUR 265M.
What is known
| People affected | 533,000,000 (as reported by the organization) |
|---|---|
| Disclosed | Apr 3, 2021 |
| Happened | Aug 1, 2019 |
| Attack | Scraping |
| Data exposed | Dates of birthEmailsEmploymentLocationNamesPhone numbers |
| Sector | Tech · US |
| Status | Settled |
| Lawsuit or fine | EUR 265M Irish DPC fine (Nov 2022) (about $275M) |
| Check your email | Have I Been Pwned |
Sources
Notices filed
Other breaches at Facebook
Hacking breachHacking exposed emails, location data, names, passwords and phone numbers.77K accountsTechUnverifiedFeb 22, 2024Twelve 2018 Facebook breach notifications; Irish DPC fine of EUR 17MTechUSMar 15, 2022Exposed server holds 419 million records linking Facebook IDs to phone numbersScraping exposed phone numbers.ScrapingTechUSUnverifiedSep 4, 2019Hundreds of millions of passwords stored in plaintext; Irish DPC fine of EUR 91MExposed data exposed passwords.Exposed dataTechUSMar 21, 20192018 View As token theft hit 29M Facebook accounts; Irish DPC fines of EUR 251MHacking exposed names, emails, phone numbers, location data, employment records, dates of birth and children's data.Hacking29M affectedTechUSSep 28, 2018Data of up to 87 million Facebook users improperly shared with Cambridge AnalyticaVendor breach exposed names and location data.Vendor breach87M affectedTechUSMar 17, 2018
History of this record
confirmed to settledby seedSource
empty to 275000000by seedSource
empty to EUR 265M Irish DPC fine (Nov 2022)by seedSource
Data on more than 530 million Facebook users, mainly phone numbers linked to profiles, was published online; Facebook said it was scraped via its contact importer before September 2019. to A dataset of phone numbers, Facebook IDs, names, locations, birth dates and some emails covering over 533 million users was posted on a hacking forum in April 2021; Facebook said it came from scraping via contact importer features. Ireland'by seedSource
Scraped data of 533 million Facebook users posted free online to Scraped dataset of 533M Facebook users posted online; Irish DPC fine of EUR 265Mby seedSource
aggregator to companyby seedSource
https://haveibeenpwned.com/Breach/Facebook to https://about.fb.com/news/2021/04/facts-on-news-reports-about-facebook-data/by seedSource
disclosed to confirmedby seedSource
empty to researchby seedSource
0 to 1by seedSource
empty to USby seedSource
unknown to scrapingby seedSource
hibp to organizationby seedSource
509458528 to 533000000by seedSource
2021-04-04 to 2021-04-03by seedSource
In April 2021, a large data set of over 500 million Facebook users was made freely available for download . Encompassing approximately 20% of Facebook's subscribers, the data was allegedly obtained by exploiting a vulnerability Facebook adv to Data on more than 530 million Facebook users, mainly phone numbers linked to profiles, was published online; Facebook said it was scraped via its contact importer before September 2019.by seedSource
empty to Scraped data of 533 million Facebook users posted free onlineby seedSource
First recordedby backfillSource
First seen 2026-09-25 (Have I Been Pwned), confirmed by Research. Record counts are as reported. Not legal advice.