On September 25, Facebook's engineering team discovered a security breach affecting almost 50 million accounts. The attackers exploited vulnerabilities in Facebook's code that targeted the "View As" feature, which lets people see what their profile looks like to someone else. Facebook took steps to resolve the issue, logging out of approximately 90 million accounts as a security precaution.
On October 12, Facebook shared a lengthy update that was a deep dive into how the breach occurred.
Here's the gist of it, and also a link to see if you were affected:
For 15 million people, attackers accessed two sets of information -- name and contact details (phone number, email, or both, depending on what people had on their profiles). For 14 million people, the attackers accessed the same two sets of information, as well as other details people had on their profiles. This included username, gender, locale/language, relationship status, religion, hometown, self-reported current city, birthdate, device types used to access Facebook, education, work, the last 10 places they checked into or were tagged in, website, people or Pages they follow, and the 15 most recent searches. For 1 million people, the attackers did not access any information.
This attack did not include Messenger, Messenger Kids, Instagram, WhatsApp... Pages, payments, third-party apps, or advertising or developer accounts.
Click here to check your account status.