# MA-803.042021: MyCERT Advisory - Potential Phishing Campaigns Arising from Facebook's Data Leak

**Date:** 15 Apr 2021  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-803.042021  
**Advisory ID:** MA-803.042021

---

**1.0 Introduction**
Recently MyCERT has come across with a report that shows a massive amount of Facebook data has circulated publicly in cybercriminal forum, splashing personal details of more than 533 million Facebook account holders including data from more than 11 million Malaysian users. The data includes things like profile names, Facebook ID numbers, email addresses, and phone numbers.
While Facebook explained that in August 2019, the vulnerability was fixed, users should still be vigilant about possible phishing efforts that arise from this leak. Threat actors may use the information they receive to carry out phishing and other attacks on social engineering. Facebook users should remain alert and look for unwanted telephone calls and messages that have been sent over SMS and instant messaging applications like WhatsApp.
Threat actors who are well-resourced can also use Caller ID spofing technology to impersonate a Facebook user and conduct further attacks. This could include:
- Impersonating the Facebook user to send malicious/phishing links, request for money transfers, or ask for One-Time Passwords (OTP) to compromise their contacts' accounts.
- Using the Facebook user's details to compromise the user's other accounts, such as resetting passwords to other online accounts, or leverage additional easily obtainable personal information about the user to request for a replacement credit or ATM card.
- Using the Facebook user's contact details to order goods and services, or make purchases under their name.
**2.0 Recommendations**
Listed below are some recommendations for users as preventive measures and mitigation steps against these attacks:
1.    Be vigilant about phishing attempts. Always be wary of suspicious emails and verify before clicking any links or downloading any attachments, especially if the email comes from an unfamiliar sender.
2.    Verify a link in an email/SMS by checking the domain name of the site, as it is an indicator of whether the site is legitimate. Users can hover their mouse over the link to ensure that they are being directed to the Uniform Resource Locator (URL) stated.
3.    Turn on login alerts, if available. The platform should send you an alert when someone logs into your account from an unrecognised device or browser. Review any unrecognised login sessions for unusual account activities such as activating email forwarding rules to unknown accounts. If you can no longer access your account, please contact the platform's support team directly to report this issue and request for their assistance.
4.    Change your passwords regularly; use a strong password of at least 12 characters which includes upper case, lower case, numbers and/or special characters. Avoid using the same password for different accounts, or using passwords that are derived from your Personally Identifiable Information (PII).
5.    Enable two-factor authentication (2FA), where available.
6.    Limit access to social media accounts. Also, limit sharing of personal information online as threat actors commonly look for and use such personal information to carry out targeted phishing.
7.    Review your account privacy settings and permissions, and adjust your privacy settings as appropriate.
8.    Report security incidents to relevant authorities or to CERTs/CSIRTs in your constituency for immediate remediation and mitigations.
Generally, MyCERT advises internet users in Malaysia to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**3.0    References**
<https://www.facebook.com/help/131297846947406>
<https://www.bleepingcomputer.com/news/security/533-million-facebook-users-phone-numbers-leaked-on-hacker-forum/>
<https://therecord.media/phone-numbers-for-533-million-facebook-users-leaked-on-hacking-forum/>
<https://www.csa.gov.sg/singcert/advisories/ad-2021-004>