AP Photo/J. Scott Applewhite
- Facebook employees had access to hundreds of millions of users' passwords — for years.
- Users' passwords were being stored in an unencrypted format, and reportedly were accessible by 20,000 workers at the company.
- Facebook says it hasn't found any evidence of misuse of the data.
- It's the latest privacy scandal to hit the besieged tech firm.
Facebook stored hundreds of millions of users' passwords in a format easily readable by its employees for years, in the latest security scandal to hit the beleaguered Silicon Valley tech giant.
Cybersecurity journalist Brian Krebs first reported the news on Thursday, and it was subsequently confirmed by a blog post from Facebook entitled "Keeping Passwords Secure."
Digital security best practices call for passwords to be stored in an encrypted format — making them unreadable even by the companies that hold them. But in Facebook's case, they were stored in plain text, meaning that anyone with access to the file could read users' passwords with no additional steps required. According to Krebs, more than 20,000 employees had access to those passwords.
It's not clear exactly how many people were affected, but Facebook says it plans to notify "hundreds of millions" of affected users of Facebook Lite (the company's lightweight app for emerging markets), "tens of millions" of regular Facebook users, and "tens of thousands" of Instagram users. Krebs, meanwhile, reports that the total number is between 200 and 600 million.
Facebook says it has "found no evidence anyone internally abused or improperly accessed" the password data, and that the issue was discovered during a "routine security review" in January 2019.
The incident is the newest in a long line of serious scandals and crises to wrack Facebook over the last two years — many of which have been security- or privacy-related. That includes the Cambridge Analytica scandal, as well as a hack of tens of millions of users' personal data.
Do you work at Facebook? Contact this reporter via Signal at +1 (650) 636-6268 using a non-work phone, email at rprice@businessinsider.com, Telegram or WeChat at robaeprice, or Twitter DM at @robaeprice. (PR pitches by email only please.) You can also contact Business Insider securely via SecureDrop.
Now read:
- Car-bomb fears and stolen prototypes: Inside Facebook's efforts to protect its 80,000 workers around the globe
- Facebook quietly killed its Building 8 skunkworks unit as it reshuffles its cutting-edge experiments and hardware
- Leaked Andreessen Horowitz data reveals how much Silicon Valley startup execs really get paid, from CEOs to Sales VPs
NOW WATCH: Everything we know about Samsung’s foldable phone
See Also:
- An internet pioneer is doubtful Mark Zuckerberg can refocus Facebook on privacy. Here's why.
- Here's the pitch deck this Austin, Texas, entrepreneur used to raise millions for a startup inspired by Mark Zuckerberg's congressional testimony
- Facebook is on the lookout for foreign spies trying to infiltrate the company
