Facebook 533M scraped records leak

On 3 April 2021, a dataset containing personal information on 533 million Facebook users across 106 countries was posted for free on a low-level hacking forum. Surfaced publicly by security researcher Alon Gal, the trove included phone numbers, Facebook IDs, full names, locations, birthdates, relationship statuses, and — for a subset — email addresses. It represented roughly 20% of Facebook's user base at the time.

What happened

The data was not stolen in a conventional intrusion. It was scraped by abusing Facebook's contact-importer feature, which was designed to help users find friends by uploading their phone contacts. By feeding the importer enormous lists of phone numbers and harvesting the matching profile data returned, attackers were able to associate millions of phone numbers with real Facebook accounts and their public-profile fields.

The scraping occurred before September 2019, when Facebook identified the flaw and patched the contact-importer behaviour. The dataset then circulated privately within criminal markets — at one point accessible through a paid Telegram lookup bot — before being dumped in full and for free in April 2021.

What was exposed

The records included, depending on the user:

• Phone number (the central and most damaging field, since phone numbers are rarely changed and widely used for account recovery and SIM-swap targeting).
• Facebook ID, full name, gender, and location/hometown.
• Birthdate and relationship status.
• Email address for a minority of records.

Notably, passwords and financial data were not part of the dataset.

Impact

• 533 million users exposed, including roughly 32 million U.S., 11 million U.K., and millions more across Europe, the Middle East, and Asia.
• Because phone numbers are durable identifiers, the leak fueled smishing, phishing, and SIM-swap campaigns for years afterward.
• Facebook declined to notify affected individuals, arguing the data was scraped rather than breached — a stance widely criticized.
• In November 2022, Ireland's Data Protection Commission fined Meta €265 million (~$290 million) for failing to implement data-protection-by-design and -by-default measures under the GDPR.

Why it matters

The incident drew a sharp public line between "hacking" and "scraping" — and exposed how little that distinction matters to affected users. Whether data is exfiltrated through an intrusion or systematically pulled through an abused legitimate feature, the harm is identical once it is dumped publicly. The case established that enumerable lookup features are a breach surface in their own right, that platforms can be held liable under the GDPR for failing to design against bulk scraping, and that phone numbers — long treated as low-sensitivity — are in fact among the most durable and exploitable identifiers a platform can leak.