A court filing on Thursday showed that some Facebook users are suing the social network over a 2018 data breach. The charge claims that Facebook, the largest social network failed to alert its users about a vulnerability in 2018, even though it protected its employees.
The vulnerability was tied to its single sign-on tool. This tool connects users to third-party apps on its platform via users’ credentials on Facebook.
The lawsuit is a combination of many legal actions against Facebook security breach in September which allowed hackers steal log in codes to access almost 29 million accounts. The plaintiffs queried in a redacted section of the filling in the US District Court in San Francisco that Facebook was well aware of the vulnerability before the havoc but chose to treat the issue like a walk in the park. “Even more egregiously, Facebook took steps to protect its own employees from security risk, but not the majority of is users,” the plaintiffs said.
Facebook is yet to respond to the lawsuit with a comment. The social network had revealed a few details initially when it disclosed the attack. It didn’t give an exact number of affected users, but admitted that the flaw it overlooked affected a “broad spectrum” of users.
The hackers stole profile details such as birth dates, employers, types of device used, location check-ins, religious preference and pages followed from 14 million users. For the other 15 million, the stolen information was restricted to names and contact details. The attackers also had access to contact list and groups of 400,000 users.
This is Facebook’s worst ever security breach.
Facebook did not deny its awareness about the flaw and neither did it deny protecting its employees or that probably it was an oversight. It only responded that the attackers did not have access to personal messages or financial data and could not have gained access to users’ accounts on other websites. This could have been very deadly.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behaviour or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
