Someone has gotten their hands on a database full of phone numbers of Facebook users, and, according to a study by Motherboard, is now selling the data using a Telegram bot. Alon Gal, the security researcher who discovered this vulnerability, says the individual who runs the bot claims to have 533 million users’ data, which came from a 2019 patched Facebook vulnerability.
With many databases, some technical skills are required to find some useful information. And there always needs to be an interaction between the person with the database and the person seeking to get information out of it, as the “owner” of the database won’t just give all that important data to anyone else. However, creating a Telegram bot addresses all of these problems.
The bot helps someone to do two things: if they have the Facebook user ID of a person, they can find the phone number of that individual, and if they have the phone number of a person, they can find their Facebook user ID. While, of course, it costs cash to actually get access to the data you’re searching for, unlocking a piece of information, such as a phone number or Facebook ID, costs one credit that the person behind the bot sells for $20. There’s also bulk pricing open, according to the Motherboard survey, with 10,000 credits selling for $5,000.
According to screenshots posted by Gal, the bot has been functioning since at least January 12, 2021, but the data to which it provides access is from 2019. That’s relatively old, but people sometimes don’t change their phone numbers. For Facebook, it is particularly humiliating because it has traditionally obtained telephone numbers from individuals, including users who have switched on two-factor authentication.
