Bug in Facebook DYI tool fixed after data of 6M users exposed

Share this article:
Bug in Facebook DYI tool fixed after data of 6M users exposed
Bug in Facebook DYI tool fixed after data of 6M users exposed

Facebook has addressed a weakness in its "Download Your Information" (DYI) tool, which exposed the contact information of around six million of its users.

The social networking site's security team notified users about the glitch via a blog post Friday, saying that users may have inadvertently had their email addresses and phone numbers shared with other users who had some connection with them.

The DYI tool is meant to help users access information stored in their profile and locate people on Facebook who they may know.

“Because of the bug, some of the information used to make friend recommendations and reduce the number of invitations we send was inadvertently stored in association with people's contact information as part of their account on Facebook,” the company wrote.

Users that downloaded an archive of their Facebook account through the DYI tool may have consequently saved additional information of contacts (email addresses and phone numbers) they wouldn't otherwise have had access to, Facebook said.

It was made aware of the security issue through its bug bounty program, where researchers are paid for reporting vulnerabilities to the company. After the bug was reported last week, Facebook disabled the DYI tool and issued a fix the following day.

The site is in the midst of notifying impacted individuals via email.
Share this article:

Sign up to our newsletters

More in News

Latest Citadel trick allows RDP access after malware's removal

Latest Citadel trick allows RDP access after malware's ...

Trusteer, an IBM company, said the new Citadel configuration was detected this month.

Cryptoblocker variant emerges, encryption differs from CryptoLocker

Trend Micro has detected a variant of CryptoLocker in the wild that relies on the advanced encryption standard.

Jimmy John's sandwich chain investigating possible breach

Some financial institutions have indicated that credit cards recently used at Jimmy John's locations have been used to make fraudulent purchases.