Facebook on Friday provided an update on a recent breach to say that 30 million people had their Facebook access tokens stolen rather than the previously announced 50 million.
Tokens are digital keys that keep you logged in to Facebook so you don't have to re-enter your password every time you open the app. With an access token, an attacker could take over your account and use it as if they were you.
But while Facebook was able to lower the number of people affected, that's cold comfort for the remaining 30 million. Of that total, 1 million people did not have any information accessed, while 15 million people had their name and contact details (phone number, email, or both, depending on what people had on their profiles) accessed.
The situation is worse for the remaining 14 million users; they had their name and contact details exposed, as well as username, gender, locale/language, relationship status, religion, hometown, self-reported current city, birthdate, device types used to access Facebook, education, work, the last 10 places they checked into or were tagged in, website, people or Pages they follow, and the 15 most recent searches accessed.
Facebook will notify the 30 million people affected with customized messages to tell them exactly what the attackers accessed from their accounts. Or you can click this link while signed into Facebook and scroll down.
"This attack did not include Messenger, Messenger Kids, Instagram, WhatsApp, Oculus, Workplace, Pages, payments, third-party apps, or advertising or developer accounts," Facebook vice president of product management Guy Rosen said in blog post—with one exception.
If an affected person was a Page admin whose Page received a message from someone over Facebook, then the hackers would've been able to view the content.
"We're cooperating with the FBI, which is actively investigating and asked us not to discuss who may be behind this attack," Rosen said.
The mysterious hackers exploited three software vulnerabilities in the company's code involving the "View As" feature, which lets you see what your profile looks like to the public or a specific individual. According to Rosen, the attackers first stole access to about 400,000 Facebook accounts, which they used as a launching pad to collect profile data from 29 million people. The attack began on Sept. 14, but Facebook only realized it was a threat by Sept. 25.
Rosen said Facebook has seen no evidence yet that the hackers have been using the stolen data. He declined to offer a location breakdown of where affected users live, but said the attack was fairly broad.
To protect users, Facebook reset the access tokens to 90 million users' accounts. Check whether you were affected by the breach by visiting the company's Help Center.