Facebook (NASDAQ: FB) discovered a security issue that allowed hackers to access information that could have let them take over around 50 Million accounts, the Company announced on Friday.
Facebook, which was already trading down about 1.5% before the announcement, extended losses to as much as 3.5% after the disclosure.
The Company said in a blog post its engineering team found that attackers identified a weakness in Facebook’s code regarding its “View As” feature on Tuesday. Facebook became aware of a potential attack after it noticed a spike in user activity on Sept. 16th.
Almost 50 Million accounts had their access tokens taken, and Facebook has reset those tokens. The Company also reset tokens for an additional 40 Million accounts who used the “View As” feature in the last year as a precautionary measure, for a total of 90 Million accounts or about 4% of total users given the 2.23 Billion monthly active users as of June 30th.
The Company suspended the “View As” feature while it reviews its security. Facebook said it fixed the issue on Thursday night and has notified law enforcement including the FBI and the Irish Data Protection Commission in order to any address General Data Protection Regulation (GDPR) issues.
Facebook said it just begun its investigation and has not determined if any information was misused, but the initial investigation has not uncovered any information abuse. The hackers did query Facebook’s API system, which lets applications communicate with the platform, to get more user information. The Company is not sure if the hackers used that data, nor does it know who orchestrated the hack or where the person or persons are based.
The Company said there is no need to change passwords. If additional accounts are affected, Facebook said it will immediately reset those users’ access tokens. Facebook is doubling the number of employees who are working to improve security from 10,000 to 20,000.