Meta Fined €91 Million for Storing Facebook and Instagram Passwords in Plaintext

Introduction

In a significant blow to its reputation and data security practices, Meta has been fined €91 million ($101.56 million) by the Irish Data Protection Commission (DPC) for a major security lapse dating back to March 2019. The investigation revealed that millions of Facebook and Instagram users' passwords were stored in plaintext, an alarming oversight for a company of Meta's scale and influence. This blog delves into the specifics of the case, how it violated the General Data Protection Regulation (GDPR), and what this means for the future of data privacy.

The Discovery of the Plaintext Password Issue

The issue first came to light in March 2019 when Meta disclosed that a subset of users' Facebook passwords had been mistakenly stored in plaintext in its systems. Passwords stored in plaintext are a significant security risk, as they are not encrypted and can be easily accessed if the system is breached. This revelation led to the DPC launching an investigation the following month to assess the full extent of the breach and to determine if Meta had violated GDPR requirements.

Further analysis by the DPC uncovered that millions of Instagram passwords were also stored in a similar insecure manner. Meta promptly notified affected users, though it assured that no evidence suggested the passwords had been improperly accessed or misused within the company.

GDPR Violations and the €91 Million Fine

The DPC concluded that Meta had violated four key articles under the European Union's GDPR, which governs the protection and confidentiality of user data across the EU. Specifically, Meta was found at fault for:

These violations underscore the importance of following strict security measures to ensure user data confidentiality, especially when handling sensitive information such as social media account passwords.

Security Oversight and Exposure

According to the investigation, some of the stored passwords dated back to 2012. The exposure was not minor—approximately 2,000 engineers or developers made nearly nine million internal queries for data elements containing plaintext user passwords. This level of access within the company underscores the risks associated with storing sensitive data in plaintext.

Graham Doyle, deputy commissioner at the DPC, emphasized that storing user passwords in plaintext is widely regarded as poor security practice due to the risks of misuse. He stressed that the passwords in question would grant access to users' social media accounts, making the breach particularly serious. Meta’s Response and Remediation

Meta responded by stating that it took "immediate action" to correct the error and proactively flagged the issue to the DPC. The company’s rapid response and acknowledgment of the oversight, while commendable, do not mitigate the severity of the incident, especially considering the massive scale of user data at risk.

Lessons for Data Security

This incident serves as a stark reminder of the importance of robust data security practices. In an age where cybersecurity breaches are rampant, storing sensitive information like passwords in plaintext is a critical vulnerability. Organizations should take immediate steps to secure their systems by:

Conclusion

Meta’s €91 million fine is a clear indication of the seriousness with which regulators view data breaches, especially when sensitive user information like passwords is at risk. For companies handling personal data, this case emphasizes the importance of strict security practices, compliance with regulations like GDPR, and prompt reporting of any breaches.

As cyber threats continue to evolve, adopting proactive security measures such as digital threat scoring and online risk evaluation will help prevent future breaches and protect both user data and company reputations.

About Foresiet!

Foresiet is the pioneering force in digital security solutions, offering the first integrated Digital Risk Protection SaaS platform. With 24x7x365 dark web monitoring and proactive threat intelligence, Foresiet safeguards against data breaches and intellectual property theft. Our robust suite includes brand protection, takedown services, and supply chain assessment, enhancing your organization's defense mechanisms. Attack surface management is a key component of our approach, ensuring comprehensive protection across all vulnerable points. Compliance is assured through adherence to ISO27001, NIST, GDPR, PCI, SOX, HIPAA, SAMA, CITC, and Third Party regulations. Additionally, our advanced antiphishing shield provides unparalleled protection against malicious emails. Trust Foresiet to empower your organization to navigate the digital landscape securely and confidently.