Your Facebook Profile is Worth Less Than a Penny to Cybercriminals
By: Alexys Carlton
Tags: Privacy, Cybersecurity, Facebook, Technology, Data Breach

Your Facebook Profile is Worth Less Than a Penny to Cybercriminals

How To Protect Yourself From the Facebook Data For Sale on the Dark Web

Photo by Declan Lopez on Unsplash

Last year, I had the opportunity to discuss Internet crime with an FBI agent who investigates complaints reported to the FBI Internet Crime Complaint Center. I vividly remember one phishing email case the agent shared. Unknowingly, a couple had authorized a wire transfer to a cybercriminal disguised as their residential developer. Because the couple had approved the transfer themselves (versus their credentials being stolen), the transaction was not covered by fraud protection. The criminal stole the couple’s life’s savings.

Stories like this one are the best treatment for data breach fatigue. Protecting our data is exhausting, especially when companies break our trust almost weekly. But failure to act may result in significant financial and emotional consequences.

On April 21, 2020, cybercriminals posted a database containing 267 million Facebook profiles for sale on the Dark Web and hacker forums. People could buy the database for $623 ($0.0000023 per record). This article provides a quick overview of what happened, how the data may be used, and what you can do to protect yourself.

What Happened?

Thank the Privacy Gods for security researchers. Last December, a security researcher discovered a publicly exposed database containing 267 million Facebook user IDs, names, and phone numbers. 16.8 million records also included email addresses, birth date, and gender. The researcher believes it was owned by a cybercriminal organization, not Facebook. Then, on April 21, 2020, the criminal organization posted the database for sale for $623 on the Dark Web and hacker forums.

It’s unclear how the user data was obtained. The security researcher has three possible theories:

It was obtained before 2018 when Facebook still allowed developer access to user data, including phone numbers, via their Developer API. The current Developer API has a bug allowing the data to be harvested. The data was scrapped and compiled from publicly available webpages.

How Can The Data Be Used For Harm?

Photo by stephen momot on Unsplash

The cybercriminals who buy this database will likely use the data for targeted phishing attacks, both via email and text message (aka “smishing”). They will spam the masses, hoping a lucrative target will fall for their bait. Your phone number is worth less than a penny, but they can use it to trick you into clicking links. Those links may encourage you to give them your login credentials, download malware, or provide more lucrative personal data, such as your social credit number or credit card number.

What Should You Do to Protect Yourself?

Live with a healthy dose of digital paranoia. Are you sure that email is from your mom? Did you enter to win a trip or gift card? Is the link the actual URL to your bank? It is okay to question the messages you receive. If I am not sure who sent it, I call the person via the contact information I have on file. Trash your email address and start over. If your personal email address has been exposed, it’s time to get a new one. Remember to change your email address on your online accounts before deleting the old one. Use a tool like haveibeenpwned to see if your email address has been compromised. Consider limiting the personal data you share online. Complete a digital spring cleaning to reduce your future exposure. Identify the services you no longer value and start closing accounts and asking those companies to delete your personal information. I find that most companies will respect your request to remove your data even without a legal right. Read their privacy notice to find out how to submit your request.

I dream of a world where we make it more challenging for cybercriminals to succeed. A proactive world with vigilant users and sophisticated data protection practices. The cybercriminal would be admired, applauded every time they compromised a system. Because each time they succeed in this world, we would experience their intelligence and determination.

But until then, we must live with awareness and take action. We must not succumb to data breach fatigue.