WhatsApp denies breach that allegedly leaked nearly 500 million phone numbers

In a statement, a WhatsApp spokesperson said the data breach report was “based on undocumented screenshots” and that the company had “no evidence of a ‘data leak'”.

“The claim written on Cybernews is based on unsubstantiated screenshots. There is no evidence of a WhatsApp ‘data leak’,” the spokesperson said.

On Saturday, CyberNews, a cybersecurity-focused publication, said a threat actor sold a database containing the phone numbers of over 487 million WhatsApp users. Of this, nearly 6.2 million phone numbers belonged to users located in India. The report, which included screenshots of the allegedly leaked phone numbers, did not clarify whether the database also included names and other details of users who owned the said phone numbers.

After the report, Jurgita Lapienytė, editor-in-chief of CyberNews, tweeted that there was no evidence of a hack. “There is no evidence that WhatsApp has been hacked. The leak may be a scratch, but that doesn’t mean it’s any less dangerous for the affected users,” she wrote.

Security experts said that even without an elaborate set of details, such as names or other identification, leaked databases — if verified — are often purchased by cybercriminals, who later use those phone numbers to launch scams that can include phishing, identity theft and other related activities.

“Collecting phone numbers is a very common practice today, and hackers often find customers like telemarketers – who buy such databases to sell their products. Even without a name attached to a number, such databases still find many customers,” said Sandip Kumar Panda, founder and CEO of Bengaluru-based cyber security firm InstaSafe Technologies.

However, Panda added that with data breaches becoming commonplace, it is also important to authenticate the veracity of breach-related claims.

“Meta, as a publicly traded global firm, is bound by compliance to disclose any data breach. Given that they have denied the breach so far, the alleged database is largely speculative and we have found no conclusive evidence that the leak is authentic ,” he said.

To be sure, this was not the first time a data breach of this proportion has been alleged against a Meta Platforms app. In April last year, a report by PTI claimed to have discovered a database that included phone numbers, names, social media IDs, locations, profile bios and even email addresses of over 533 million users in 106 nations. Of this, at least 6 million users were reportedly based in India.

At the time, a Facebook spokesperson acknowledged the breach, telling PTI that the leaked data was “previously reported” in 2019, which the company had fixed at the time.

In 2018, Meta (then Facebook) CEO Mark Zuckerberg said in light of the Cambridge Analytica scandal that the company would limit access to user data for third-party apps – a factor that largely contributed to the data breach of Facebook users.

Three years since one of the largest data collection and disinformation campaigns on the internet, Meta said on October 8 that it would inform one million users of their personal data breached through over 400 malicious apps on Android and iOS devices that tapped into Facebook’s database to connect users.

In September last year, the Irish Data Protection Commission had fined WhatsApp €225 million for alleged inconsistencies in how the Meta-owned service handled personal information about users. Two months later, the company published a new privacy policy for its users in Europe, which clarified how the service collected and processed user data in the region.

However, WhatsApp stated at the time that the privacy policy update did not change the way it operated, including how user data was “processed, used or shared with anyone, including parent company Meta.”