Tech

Facebook employees had unfettered access to hundreds of millions of users' unencrypted passwords for years

By Rob Price
facebook mark zuckerberg
Facebook CEO Mark Zuckerberg in a waiting room in Washington last year. AP Photo/J. Scott Applewhite
Read in app

Facebook stored hundreds of millions of users' passwords in a format easily readable by its employees for years, in the latest security scandal to hit the beleaguered Silicon Valley tech giant.

The cybersecurity journalist Brian Krebs first reported the news on Thursday, and Facebook subsequently confirmed it in a blog post titled "Keeping Passwords Secure."

Digital security best practices call for passwords to be stored in an encrypted format — making them unreadable even by the companies that hold them. But in Facebook's case, they were stored in plain text, meaning that anyone with access to the file could read users' passwords with no additional steps required. According to Krebs, more than 20,000 employees had access to those passwords.

It's not clear exactly how many people were affected, but Facebook says it plans to notify "hundreds of millions" of affected users of Facebook Lite (the company's lightweight app for emerging markets), "tens of millions" of regular Facebook users, and "tens of thousands" of Instagram users. Krebs reports that the total number is between 200 million and 600 million.

Facebook said that it had "found no evidence anyone internally abused or improperly accessed" the password data and that the issue was discovered during a "routine security review" in January. Krebs said the issue existed as far back as 2012.

The incident is the newest in a long line of serious scandals and crises to wrack Facebook over the past two years — many of which have been security- or privacy-related. That includes the Cambridge Analytica scandal as well as a hack of tens of millions of users' personal data.

Do you work at Facebook? Contact this reporter via Signal at +1 (650) 636-6268 using a non-work phone, email at rprice@bjinnox.com, Telegram or WeChat at robaeprice, or Twitter DM at @robaeprice. (PR pitches by email only please.) You can also contact Business Insider securely via SecureDrop.

Now read:

Read next

极速168赛车官方网站图片

Business Insider tells the innovative stories you want to know

极速168赛车官方网站图片

Business Insider tells the innovative stories you want to know

极速168赛车官方网站图片

Business Insider tells the innovative stories you want to know

极速168赛车官方网站图片

Business Insider tells the innovative stories you want to know

Reporter Rob Price sitting at a table
Rob Price
Rob Price was a senior correspondent at Business Insider, based in San Francisco. He wrote investigations and long-form features about platforms, people, and power in Silicon Valley.His stories variously led to attorney general investigations, large-scale internal reviews at major tech companies, high-profile personnel departures, citation by state and federal lawmakers, and the closure of a well-funded startup. His 2022 story on the Bitfinex hack is being adapted into a feature film, and in 2024 he received an SPJ NorCal Excellence in Journalism award for his reporting on AI and relationships.Rob's scoops and exclusive stories were cited by The New York Times, Bloomberg, the BBC, Associated Press, Reuters, CNBC, Politico, The Guardian, Axios, and many other national and international publications. His writing has also been published in or syndicated by The Washington Post, The Independent, Vice, Slate, and elsewhere, and he appeared on CNN, the BBC, CBS, Reuters, ABC Australia, and other broadcast media to discuss technology, business, and culture.He worked for Business Insider from 2015 to 2025. Prior to joining the features team, Rob covered Facebook and Silicon Valley, and before that wrote about tech business, policy, and the gig economy in London. Between September and October 2019, he was acting executive editor for Business Insider's UK bureau. He also sat on the board of directors for the San Francisco Press Club, the leading non-profit media advocacy group in the Bay Area, and was a volunteer crew member at the Marine Mammal Center, the world's largest animal hospital for marine mammals. You can contact Rob Price via email at robaeprice@gmail.com, or +1 650-636-6268 (Signal / WhatsApp / Cell). Selected stories:— They spoke out against their employer. Then they were hit with trade secrets suits.— The rise of 'shadow stand-ins'— App, Lover, Muse: Inside a 47-year-old Minnesota man's three-year relationship with an AI chatbot— Deel Speed: The inside story of a $12 billion HR startup's breakneck growth— Private islands, flying cars, and psychedelic parties: Inside the wild post-Google lives of Larry Page and Sergey Brin— 'I want your Instagram account': First came the threatening texts, followed by the SWAT teams. Then someone wound up dead.— Inside Iconiq: How Mark Zuckerberg's banker built a secret Silicon Valley empire and made billions— Gaia was a wildly popular yoga brand. Now it's a publicly traded Netflix rival pushing conspiracy theories while employees fear the CEO is invading their dreams— A drunken late-night assault allegation has roiled the secretive world of Mark Zuckerberg's private family office. Personal aides are speaking out about claims that household staff endured sexual harassment and racism from their colleagues.
HOME Subscribe