Data of over 500M Facebook users, including 6M Indians, leaked

The database of the latest alleged leak includes details of roughly 0.55 million users from Afghanistan, 1.2 million from Australia, 3.8 million from Bangladesh, 8 million from Brazil, and 6.1 million from India.

Alon Gal—the co-founder and CTO of cybersecurity firm Hudson Rock—shared details of the leaked database on Twitter.

If someone had a Facebook account, their data had likely been leaked, he said.

The database was first leaked in 2019 and was sold on Telegram for $20 per search. Gal was the first to flag the leak.

At the time, Facebook said the vulnerability that caused the leak (allowing users to search for a person's number) had been patched.

In June 2020 and January 2021, the same database was leaked again. The vulnerability was the same.

The latest breach is the second such incident in 10 days in India.

Earlier on Tuesday, details of about 10 crore MobiKwik users had allegedly been leaked and sold on the dark web. MobiKwik is a Gurugram-based digital wallet company.

The database had been in the public domain for over a month. The issue came to light after it was posted for sale.

With the Personal Data Protection Bill sitting pending in the Lok Sabha since 2019, India lacks a robust mechanism for user data protection and penal actions.

The Bill contains provisions for cases involving data breaches.

A Joint Parliamentary Committee has sought to extend the submission of its report on the Bill till the first week of Parliament's Monsoon Session.