Thread by @FBoversight

Explaining the Facebook data breach of 533 million users: A THREAD 🧵⬇️

On April 3, 2021, @aaronpholmes broke the story that personal information from 533 million Facebook users had been posted online by a malicious actor. /1
businessinsider.com/stolen-data-of…

According to Facebook, a data breach of user information occurred “prior to September 2019” executed by “malicious actors.” /2
facebook.com/help/463983701…

RFOB shared resources such as “haveIbeenpwned” by @troyhunt to try to help people understand if they were a part of the breach. We also worked to make sure people whose data had been breached could contact the FTC or their Representative. /3

https://twitter.com/FBoversight/status/1379198037126447106?s=20

Facebook’s PR team Tweeted at us and others trying to downplay the breach, calling it a previously resolved issue. Nothing much happened over the weekend over the Easter weekend. Very few outlets picked it up. But we kept on tweeting... /4

https://twitter.com/FBoversight/status/1378718579831496708?s=20

On April 6, RFOB contacted the @DPCIreland - Facebook's regulator in Europe - to ask if Facebook had reported the breach. We were SHOCKED to discover Facebook had not. In fact, the Irish DPC told us that "it received no proactive communication from Facebook." /5

RFOB also contacted Facebook's press office with a set of questions. Facebook ignored us and made no attempt to answer them. /6

https://twitter.com/FBoversight/status/1380589382315470848?s=20

On April 7, 2021, @jason_kint convened an important meeting on Twitter Spaces of experts, journalists, and technologists that identified the breach. All of the panelists shared their concerns about Facebook’s inaction and PR response around this breach. /7

https://twitter.com/jason_kint/status/1385269709910814721?s=20

On April 14, 2021, crucially, the @DPCIreland announced a probe into Facebook for violations of GDPR stating that “one or more provisions of the GDPR and/or the Data Protection Act 2018 may have been, and/or are being, infringed in relation to Facebook Users’ personal data.” /8

On April 20, 2021 @intidc and journalist @Pieterjanvl released a leaked internal Facebook memo that showed how Facebook’s PR team was trying to actively downplay the nature of the breach and avoid criticism for not being transparent. /9

https://twitter.com/intidc/status/1384438899443908610?s=20

Ethical hacker and breach expert @intidc sat down with the RFOB team for an exclusive discussion on his discovery of the Facebook data breach of 533 million users, following the news of the leaked memo. /10

https://twitter.com/FBoversight/status/1386726652164677638?s=20

As revealed by @intidc and @Pieterjanvl, Facebook's PR response is NOT to protect you, the user. It's to prioritize profit and growth over privacy, over user security. They will continue to downplay and sweep this under the rug unless WE continue to put pressure on them. /11

*Correction: Facebook has still not acknowledged this is a data "breach."