This guide brings together and replaces our earlier news posts on Facebook's privacy and security incidents from 2018 to 2020, rewritten and expanded in October 2026 as a sourced reference.
For Facebook, 2018 opened with the Cambridge Analytica revelations, covered in our separate post on how to tell if your information was shared with Cambridge Analytica. What followed was not a single scandal but a run of smaller, very different incidents: a senior founder walking out, a sharing bug, a large account-takeover attack, a security feature that doubled as a search tool, careless outside developers, and regulators who were still issuing decisions about those years in 2024 and beyond.
The scale is what made each one matter. Ireland's Data Protection Commission (DPC) later found that the 2018 "View As" attack affected about 29 million Facebook accounts worldwide, and fined Meta €251 million for it in December 2024. In Canada, the Competition Bureau concluded that Facebook's privacy claims between 2012 and 2018 did not match how it actually shared data, and the company paid a $9 million penalty. This page sets out each case in order: what happened, the documented impact, how the company and regulators responded, and what happened next.
In this guide
- April 2018: WhatsApp co-founder Jan Koum leaves Facebook
- May to June 2018: a bug makes 14 million users' new posts public
- September 2018: the "View As" access-token breach
- March 2019: two-factor phone numbers turn out to be searchable
- April 2019: third-party app data left open on Amazon S3
- May 2020: Canada's $9 million penalty over privacy claims
- Timeline and summary table
- What this means for you, and for organizations
- FAQ
A note on sources: numbers on this page come from Facebook's own announcements, regulator decisions or major news outlets, and each is linked in the Sources list at the end. Where accounts differ, for example 30 million versus 29 million accounts in the 2018 breach, both figures are given with their source.
April 2018: WhatsApp co-founder Jan Koum leaves Facebook
What happened
On 30 April 2018, WhatsApp co-founder and chief executive Jan Koum announced in a Facebook post that he planned to leave the company. Facebook had bought WhatsApp four years earlier in a deal widely reported at $19 billion. Koum's own post was warm and personal: he said it was time to move on and that he would take time off for hobbies, including collecting air-cooled Porsches and playing ultimate frisbee.
The same day, The Washington Post reported that Koum had clashed with Facebook over WhatsApp's strategy and over Facebook's attempts to use its personal data and weaken its encryption, according to a CNET report republished by CBS News. The Post also reported that Koum would leave Facebook's board. Koum himself did not give those reasons publicly, so they should be read as reported accounts rather than his stated explanation.
Impact
No user data was exposed in this case, and there is no figure to attach to it. Its significance was symbolic. Koum's co-founder Brian Acton had already left in late 2017, and in March 2018, in the middle of the Cambridge Analytica coverage, Acton publicly backed the "Delete Facebook" movement. With Koum gone too, both founders of the app best known for end-to-end encryption had left Facebook within months of each other, at the height of public concern over how the company handled personal data.
Response
Facebook declined to comment on The Washington Post's report, but said that Koum's departure was not immediate.
What happened next
The question of how WhatsApp data moved inside the wider Facebook group did end up before a regulator. In September 2021, the Irish DPC fined WhatsApp Ireland €225 million after an investigation, opened in December 2018, into whether WhatsApp had been transparent enough with users and non-users. The inquiry specifically covered the information WhatsApp gave about processing between WhatsApp and other Facebook companies. The European Data Protection Board (EDPB) had instructed the DPC to reassess and increase its originally proposed fine.
May to June 2018: a bug makes 14 million users' new posts public
What happened
On 7 June 2018, Facebook disclosed that a software bug had changed the default audience for new posts for as many as 14 million users. Between 18 and 27 May 2018, people who expected their posts to reach a narrower audience, such as Friends, may have had them published as Public instead.
According to CNBC, the cause was a new feature that let people highlight items such as photos on their profiles. Those featured items were set to public by default, and the bug carried that public setting over to every new post the user wrote during the period. Posts made before 18 May were not affected by the change.
Impact
Facebook's figure was up to 14 million people. There is no public count of how many of the affected posts were actually viewed by strangers, and the content involved would have varied from person to person. The window also overlapped with a legal milestone: the EU's General Data Protection Regulation (GDPR) took full effect on 25 May 2018, in the middle of the nine days the bug was live.
Response
Facebook said it had fixed the problem and changed affected posts back to each person's previous default audience. It began notifying affected users and asked them to review what they had posted during those dates. Chief privacy officer Erin Egan apologized for the mistake.
What happened next
This incident did not lead to a fine that we could find, but the issue behind it, defaults that quietly make things public, became a recurring theme in European enforcement. The DPC's 2022 Instagram decision, for example, involved a public-by-default setting for children's accounts. For users, the lasting lesson is simple: check the audience selector on a post before you share it, rather than assuming your default is still what you set.
September 2018: the "View As" access-token breach
What happened
"View As" was a Facebook feature that let you see your own profile as someone else would see it. In late September 2018, Facebook disclosed that attackers had exploited a flaw in it to steal access tokens, the digital keys that keep you logged in without re-entering your password. With a stolen token, an attacker could act as that user.
In its 12 October 2018 update, Facebook explained that the vulnerability came from an interaction of three separate bugs and existed from July 2017 until September 2018. The company first saw unusual activity on 14 September, determined on 25 September that it was an attack, and closed the vulnerability within two days. The attackers started from accounts they already controlled and used an automated technique to move from account to account, loading the profiles of about 400,000 people along the way and collecting tokens for their friends.
| Group of accounts (Facebook, October 2018) | Number | What the attackers obtained |
|---|---|---|
| Initially believed affected | About 50 million | Accounts whose tokens may have been exposed; Facebook reset them |
| Tokens actually stolen | About 30 million | Access tokens that could be used to take over the account |
| Contact details | 15 million | Name plus phone number, email address or both |
| Contact and profile details | 14 million | The same plus details such as gender, relationship status, hometown, birthdate, device types, recent check-ins and recent searches |
| No information accessed | 1 million | Tokens stolen but no profile data taken |
Source: Facebook, "An Update on the Security Issue," 12 October 2018.
Impact
Facebook said message content was not accessed, with one exception: messages sent to Pages that an affected person administered. It also said the attack did not include Messenger, Instagram, WhatsApp, Oculus, Workplace, payments, third-party apps or advertising and developer accounts. When the Irish DPC later ruled on the case, it put the total at approximately 29 million Facebook accounts worldwide, of which approximately 3 million were in the EU and European Economic Area. Facebook said the FBI was investigating and had asked the company not to discuss who might be behind the attack.
Response
Facebook said it closed the vulnerability, stopped the attack and secured accounts by resetting the access tokens of everyone potentially exposed, which meant those people had to log in again. As a precaution it also turned off "View As." The company also notified the DPC, which as Meta's lead EU regulator opened an inquiry.
What happened next
On 17 December 2024, more than six years after the attack, the DPC fined Meta Platforms Ireland a total of €251 million. Most of the fine was not about the hack itself but about how the system had been designed. The DPC found infringements of GDPR Article 25, which requires data protection by design and by default, and of Article 33, which covers how breaches are notified and documented. Deputy Commissioner Graham Doyle warned that failing to build data protection into design exposes people to serious risks.
| GDPR provision (DPC decision, December 2024) | Fine |
|---|---|
| Article 33(3): content of the breach notification | €8 million |
| Article 33(5): documenting the breach | €3 million |
| Article 25(1): data protection by design | €130 million |
| Article 25(2): data protection by default | €110 million |
| Total | €251 million |
Source: Irish Data Protection Commission press release, 17 December 2024. Meta told The Register it intended to appeal.
March 2019: two-factor phone numbers turn out to be searchable
What happened
Two-factor authentication (2FA) adds a second check when you sign in, and the easiest option for many people was a code sent by text message, which meant giving Facebook a phone number. In early March 2019, Jeremy Burge drew wide attention to the fact that a number added for 2FA could also be used by other people to find your profile.
TechCrunch reported that Facebook's "look up" setting, which controls who can find you using your phone number, defaulted to Everyone. You could narrow it to Friends of friends or Friends, but there was no option to switch it off completely. The Electronic Frontier Foundation (EFF) noted that Facebook had promised in April 2018 to stop people typing phone numbers into the search bar, but numbers could still be matched in other ways, for example when someone uploaded their phone contacts to Facebook.
Impact
There was no single breach figure at the time. The concern was the principle: a number handed over to protect an account was also being used to connect identities. TechCrunch also pointed back to a 2018 Gizmodo report that a 2FA phone number had become targetable by advertisers, which Facebook later admitted. EFF argued that this forced people who need 2FA into an unnecessary choice between security and privacy.
Response
A Facebook spokesperson told TechCrunch that the settings were not new and applied to any phone number on a profile, not only 2FA numbers. The company said the default helped people find friends they were not yet connected with, said it would consider the feedback, and declined to say whether it would add a full opt-out. EFF noted that Facebook had already stopped requiring a phone number to enroll in 2FA in May 2018.
What happened next
Phone-number matching turned out to be a real data-protection problem. In April 2021, a dataset with information on more than 533 million people from over 100 countries was reportedly posted online, gathered by "scraping" Facebook's contact import and search features. The DPC opened an inquiry that month into Facebook Search, the Messenger Contact Importer and the Instagram Contact Importer for the period from 25 May 2018 to September 2019. On 28 November 2022 it announced a €265 million fine for failing to meet GDPR's data protection by design and by default requirements. Meta said it had removed the ability to scrape its features using phone numbers.
April 2019: third-party app data left open on Amazon S3
What happened
In early April 2019, researchers at the security firm UpGuard reported that two companies building on Facebook's platform had left user data in Amazon Web Services S3 storage that anyone could open without a password. The first, Cultura Colectiva, a digital media company, had a 146GB dataset of more than 540 million records, including account IDs, names, comments, likes and reactions. The second, an app called At the Pool, held names, email addresses, Facebook IDs and the plain-text passwords of about 22,000 people.
Impact
It is not known whether anyone else accessed the files before they were found, or for how long they were exposed. Cultura Colectiva said the records came from interactions with its own Facebook pages and that no emails or passwords were included. UpGuard said the At the Pool passwords were probably for that app rather than Facebook itself, but anyone who reused the same password elsewhere was at risk. At the Pool had been inactive since 2014, according to ESET's WeLiveSecurity.
Response
UpGuard and Amazon had tried to alert Cultura Colectiva since early January 2019. The dataset was secured only after Bloomberg contacted Facebook, which in turn contacted Amazon. Facebook said its policies prohibit storing Facebook information in a public database and that it worked with Amazon to take the data down once it was told.
What happened next
The case showed that data copied out of a platform is only as safe as the weakest developer holding it, which was also the core of the Cambridge Analytica story. Password handling became a separate regulatory matter for Facebook itself in the same month: in April 2019, the company notified the DPC that it had stored some users' passwords in plain text on internal systems. The DPC fined Meta €91 million for that in September 2024, finding breaches of the GDPR's security and breach-notification rules.
May 2020: Canada's $9 million penalty over privacy claims
What happened
On 19 May 2020, Canada's Competition Bureau announced that Facebook had agreed to pay a $9 million penalty to settle concerns that it made false or misleading claims about the privacy of Canadians' personal information. Unusually, this was a consumer-protection case rather than a privacy-law case: the issue was whether Facebook's marketing matched reality.
Impact
The Bureau examined the period from August 2012 to June 2018. It concluded that Facebook gave the impression that users could control who saw their information, through tools such as privacy settings and post audience selectors, while not limiting some third-party developers' access in the same way. That access could include posts, Messenger messages and other identifiable information. Facebook had said it would stop developers accessing friends' data after 30 April 2015, but the Bureau found some still had access until 2018.
Response
The settlement was registered with the Competition Tribunal the same day. Besides the $9 million penalty, Facebook paid $500,000 toward the cost of the investigation and agreed not to make false or misleading statements about how it discloses personal information, including how much control users have on Facebook and Messenger. The Bureau noted Facebook's cooperation.
What happened next
A separate Canadian case, brought by the Office of the Privacy Commissioner of Canada over the app linked to Cambridge Analytica, kept going. The Federal Court first sided with Facebook, but the Federal Court of Appeal overturned that decision in 2024, finding that users' friends would have had at best a vague picture of how apps could use their data. Facebook appealed to the Supreme Court of Canada, which heard arguments in March 2026, according to Courthouse News. The court had not ruled when the hearing was reported; check for a decision before relying on this summary.
Timeline and summary table
The incidents themselves cluster in 2018 and 2019, but the regulatory consequences stretched into the mid-2020s. This timeline shows both.
- 30 April 2018
Jan Koum announces he is leaving; The Washington Post reports clashes over data and encryption. - 18 to 27 May 2018
A bug sets new posts to Public for up to 14 million users. - 25 May 2018
The GDPR takes full effect across the EU. - 7 June 2018
Facebook discloses the public-posts bug and notifies affected users. - 14 to 27 September 2018
Facebook spots unusual activity, identifies the "View As" attack and closes the flaw. - 12 October 2018
Facebook updates the breach: about 30 million access tokens stolen. - March 2019
Searchable 2FA phone numbers draw criticism; Facebook says the settings are not new. - April 2019
UpGuard reports exposed third-party datasets; Facebook notifies the DPC about plain-text passwords. - 19 May 2020
Canada's Competition Bureau announces a $9 million penalty plus $500,000 in costs. - 2 September 2021
DPC fines WhatsApp €225 million over transparency. - 28 November 2022
DPC fines Meta €265 million over phone-number scraping tools. - 27 September 2024
DPC fines Meta €91 million over plain-text passwords. - 17 December 2024
DPC fines Meta €251 million over the 2018 "View As" breach. - March 2026
Supreme Court of Canada hears the Privacy Commissioner's case against Facebook.
| Case | When | Documented scale | Main outcome |
|---|---|---|---|
| Jan Koum departs | April 2018 | No data exposed | Reported disagreement over data and encryption; later €225M WhatsApp transparency fine (2021) |
| Public-posts bug | May to June 2018 | Up to 14 million users | Settings reset, users notified, apology |
| "View As" breach | Sept to Oct 2018 | About 29 to 30 million accounts | €251M DPC fine (2024) |
| 2FA phone lookup | March 2019 | Not quantified at the time | Later €265M DPC fine over contact tools and scraping (2022) |
| Third-party S3 exposure | April 2019 | 540 million records; 22,000 plain-text passwords | Data taken down after media contact |
| Canada misleading claims | May 2020 | Canadian users, 2012 to 2018 | $9M penalty plus $500,000 costs |
What this means for you, and for organizations
These cases are history, but the habits they point to are current. Menu names in Facebook and Instagram change often, so where a path is given below, use the search box in Settings if it has moved.
For individuals
- Check the audience before you post. The 2018 bug showed that defaults can change without you noticing. Glance at the audience selector each time, and review your default audience in the privacy settings once in a while.
- Prefer an authenticator app or passkey over text-message 2FA. Two-factor authentication is still worth turning on. If you would rather not give a platform your phone number, an authenticator app or a passkey avoids it where supported. Look for the two-factor options in Meta's Accounts Center, or search Settings for "two-factor."
- Limit who can find you by phone number or email. In Facebook's settings, search for "phone number" or "how people find you" and set the lookup options as narrowly as they will go.
- Review where you're logged in. The "View As" attack worked by stealing login tokens. Search Settings for "where you're logged in" and log out of devices you don't recognize.
- Prune connected apps. Outside developers were behind both the Cambridge Analytica and 2019 S3 cases. In Settings, search for "Apps and websites" and remove apps you no longer use.
- Never reuse passwords. The At the Pool passwords were only for that app, but reuse turns one small leak into many. A password manager makes unique passwords easy.
For organizations
- Design privacy into features from the start. The two largest fines here, €265 million and €251 million, were both mainly for breaching GDPR Article 25, data protection by design and by default.
- Don't repurpose security data. Information collected to protect an account, such as a 2FA phone number, should be used only for that purpose.
- Lock down cloud storage. Public S3 buckets caused the 2019 exposure. Block public access by default and regularly audit what is exposed.
- Notify and document breaches properly. GDPR Article 33 requires notifying the regulator within 72 hours where feasible, and documenting every breach. Meta was fined under Article 33 in both the 2018 breach and plain-text password cases.
- Make your privacy claims match your practices. The Canadian case was about marketing, not hacking. Regulators can treat inaccurate privacy promises as misleading advertising.
FAQ
Was the 2018 "View As" breach connected to Cambridge Analytica?
No. Cambridge Analytica involved data gathered by a third-party quiz app through Facebook's developer platform. The "View As" breach was an outside attack that exploited bugs in Facebook's own code to steal login tokens. Both happened in 2018, which is why they are often confused.
Why does an Irish regulator fine Facebook for events affecting people worldwide?
Under the GDPR's "one-stop shop" system, the authority where a company has its main EU establishment leads cross-border cases. For Meta, that is Meta Platforms Ireland in Dublin, so the Irish DPC leads. Its fines cover the processing of people in the EU and EEA, not the whole world, which is why it counted about 3 million EU accounts in the 2018 breach.
How can I tell if I was affected by one of these incidents?
Facebook notified people affected by the 2018 bug and the "View As" breach at the time. For later leaks of scraped data, reputable breach-notification services let you check whether your email address or phone number appears in known datasets. Either way, the safest response is the same: use a unique password, turn on two-factor authentication and review your logged-in devices.
Did Meta accept these fines?
Not always. Meta told The Register that it intended to appeal the 2024 €251 million decision, and appeals of Irish DPC decisions can take years. The Canadian $9 million settlement was a negotiated agreement registered with the Competition Tribunal.
Sources
- Facebook: An Update on the Security Issue (12 October 2018)
- CNBC: Facebook bug made private posts of up to 14 million users public
- CBS News/CNET: WhatsApp founder to depart after reported spat with Facebook
- TechCrunch: Facebook won't let you opt out of its phone number "look up" setting
- EFF: Facebook doubles down on misusing your phone number
- WeLiveSecurity (ESET): 540 million records on Facebook users exposed by third-party apps
- Competition Bureau Canada: Facebook to pay $9 million penalty
- Irish DPC: fines Meta €251 million (December 2024)
- The Register: Ireland fines Meta for 2018 breach
- Irish DPC: decision in Facebook "data scraping" inquiry (€265 million)
- NBC News: Irish watchdog fines Meta 265 million euros
- Irish DPC: fines Meta Ireland €91 million (plain-text passwords)
- Irish DPC: decision in WhatsApp inquiry (€225 million)
- Irish DPC: decision in Instagram inquiry
- Courthouse News: Canada's Supreme Court scrutinizes Facebook's role in Cambridge Analytica scandal
- ICANN: Temporary Specification background (GDPR effective 25 May 2018)
- GDPR Article 33: notification of a personal data breach
Top image: "Meta HQ 2023" by InvadingInvader, CC BY-SA 4.0, via Wikimedia Commons (resized). Charts by Thank You Robot.
0 Comments