Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook does not plan to notify half-billion users affected by data leak

reuters.com

Post reply on HN
Print view View original

51–60 of 101 posts

Re: Facebook does not plan to notify half-billion users affected by data leak

#51

Post by seniorivn »

nerbert wrote: post #41
t0mas88 wrote: post #38

Earlier quoted context omitted.

They are absolutely required to report this to the data protection agencies in all European countries. As the other comment mentioned, missing the 72 hour deadline on this is enough to get a fine as Booking.com did. I'm curious to see the total in GDPR fines from this for Facebook. Will probably take a year or two before we know.

At this point they must be like a deer in front of the flashlights, hoping the car will dodge them.

it's more like a bug, Facebook won't even notice couple of millions

Re: Facebook does not plan to notify half-billion users affected by data leak

#52

Post by bostonsre »

Johnny555 wrote: post #32

Aren't they required to disclose this, at least to California residents, under California's data breach disclosure laws? Or was it not the type of PII covered under the law?

"Facebook, which has long been under scrutiny over how it handles user privacy, in 2019 reached a landmark settlement with the U.S. Federal Trade Commission over its investigation into allegations the company misused user data. [...]

The July 2019 FTC settlement requires Facebook to report details about unauthorized access to data on 500 or more users within 30 days of confirming an incident."

Seems like it.

Re: Facebook does not plan to notify half-billion users affected by data leak

#53

Post by nuclear_eclipse »

bassdropvroom wrote: post #50

So after longing it out, today I had a look on haveibeenpwned, and it seems I am one of those whose data has leaked. After re-reading all of the events of this breach, it seems that the exploit was fixed in Aug 2019 (as claimed by Facebook). I had deleted my account some 2 years prior to that. Either these attackers have had access for over 2 years, or Facebook has not deleted my data, and likely everyone else's data…

Assuming that the data is just your phone number and name/email, is it not possible that this is just from friends who have allowed Facebook and/or Messenger to share contact info? Your original account data almost certainly would have been deleted/purged due to various regulatory requirements, but that doesn't necessarily stop your contact info from being shared again and making its way back into the system.

Re: Facebook does not plan to notify half-billion users affected by data leak

#54

Post by bostonsre »

1-6 wrote: post #5

Sometimes I wonder if the data from the cameras on my Oculus Quest 2 is being sent to FB's servers and kept. I guess I'll never know.

Yea.. felt like I sold my soul when I bought one and needed to create a fb account. But in death: unchained is so damn fun. I've always wondered if they operate oculus at a massive loss all so that they can collect a bunch of data. Does anyone know if the facebook info dump stuff shows what oculus data they collect?

Re: Facebook does not plan to notify half-billion users affected by data leak

#55

Post by pieter_mj »

bassdropvroom wrote: post #50

So after longing it out, today I had a look on haveibeenpwned, and it seems I am one of those whose data has leaked. After re-reading all of the events of this breach, it seems that the exploit was fixed in Aug 2019 (as claimed by Facebook). I had deleted my account some 2 years prior to that. Either these attackers have had access for over 2 years, or Facebook has not deleted my data, and likely everyone else's data…

Check out the following twitter thread : https://twitter.com/carolecadwalla/status/137983433288654029...

Renowned hacker Inti De Ceukelaire informed facebook of this breach in 2017, but FB just sat on it for a year and did nothing, ultimately claiming it was scraped from publicly available data at the time.

So while we do not know and can only assume deleted data is merely indicated by a flag and not really deleted, this exploit does not include data from closed/deleted accounts.

FB doesn't allow user access to/control of/deletion of shadow account data, which is in violation of the GDPR.

Re: Facebook does not plan to notify half-billion users affected by data leak

#56

Post by smcl »

t0mas88 wrote: post #42
woudsma wrote: post #15

And they apparently also didn't plan on deleting my PII (phone number was in the leak), even after I permanently deleted my account at FB over 3 years ago. I thought I had the 'right to be forgotten' because of the GDPR, as I'm a European citizen. Has there been any real enforcement of these laws aside from the relatively small fine here and there? I've been blocking FB actively for the last few years, I can't even v…

If you're in Europe you can file a complaint with your local data protection agency. They will definitely already have some investigation on Facebook so this just adds more to it.

Here is how you find that, by the way: https://edpb.europa.eu/about-edpb/board/members_en

Re: Facebook does not plan to notify half-billion users affected by data leak

#57

Post by hnbad »

challengly wrote: post #48
t0mas88 wrote: post #38

Earlier quoted context omitted.

They are absolutely required to report this to the data protection agencies in all European countries. As the other comment mentioned, missing the 72 hour deadline on this is enough to get a fine as Booking.com did. I'm curious to see the total in GDPR fines from this for Facebook. Will probably take a year or two before we know.

GDPR is a gift to large corporations. Regulatory capture in return for a slap on the wrist. It also burdens startup competition and trains people to click "Allow Cookies" and "Accept the Terms of Service" as fast as possible.

GDPR is extremely similar to pre-existing privacy laws in some EU countries. It also applies to startups and large corporations equally, and in practice is more likely to be lenient towards startups making genuine mistakes while trying to obey the rules versus large corporations intentionally ignoring them.

The "Allow Cookies" and "Accept Terms of Service" click-throughs also barely meet any of the GDPR requirements and in the case of the latter don't necessarily constitute informed consent: EU courts have repeatedly ruled that a wall of text can not be used in software to hide "surprising" rules (e.g. that your WhatsApp account will be banned if you use a third-party client).

Re: Facebook does not plan to notify half-billion users affected by data leak

#58

Post by imoverclocked »

amacalac wrote: post #6

Yeah, can you imagine them having to tell Zuck his number got leaked. He's gonna be furious! Source: https://www.androidauthority.com/mark-zuckerberg-signal-1215...

I guess his users can now call him directly to air grievances over data leaks.

Re: Facebook does not plan to notify half-billion users affected by data leak

#60

Post by varispeed »

That's what I thought. GDPR was created mainly to spend tax payer money on thousands of meetings, lawyers, dinners, conferences and whatever else was possible just to tick few boxes, give people false sense of security and pat themselves on the back while salivating over buffed up bank accounts. For such a blatant disregard for the law, surely they should have been fined by now? Given that they can just exist like that it seems to me they are probably selling or supplying governments with information about citizens, so they may be above the law because of that.
Post reply on HN