This content is not available in your region

Facebook left 'hundreds of millions' of user passwords unencrypted

Image: Mark Zuckerberg
Facebook CEO Mark Zuckerberg speaks during a press conference in Paris on May 23, 2018.   -  
Bertrand Guay AFP - Getty Images file
Text size Aa Aa

Facebook said on Thursday that an internal security review found the passwords of hundreds of millions of users had been stored on company servers without encryption, but that no passwords leaked and the company has found no indication the sensitive data was improperly accessed.

The security issue was first reported by security researcher Brian Krebs, who published a blog post on Thursday detailing that Facebook employees built applications that captured the passwords of users and stored them as plain text, meaning a password would be readable just the same as it is entered to log in.

Shortly after Krebs published his post, Facebook issued its own post on the security issue.

"As part of a routine security review in January, we found that some user passwords were being stored in a readable format within our internal data storage systems," Pedro Canahuati, vice president of engineering for security and privacy at Facebook, wrote in a blog post. "This caught our attention because our login systems are designed to mask passwords using techniques that make them unreadable."

The company said it will be notifying all affected users as a precaution.

Most companies encrypt passwords to prevent them from being stolen in the event of a data breach or used for nefarious purposes by company employees. Facebook said it is standard procedure for the company to encrypt passwords.

While it appears no user passwords were leaked, the security issue adds to Facebook's lengthy list of missteps that have brought significant public and political pressure on the company in the past year.

Facebook did not immediately respond to a request for comment.

It was not immediately clear exactly how many Facebook users were affected by the security issue, but Canahuati wrote that the company estimates it will notify "hundreds of millions of Facebook Lite users, tens of millions of other Facebook users, and tens of thousands of Instagram users." Facebook Lite is a stripped-down version of the company's app offered in parts of the world that have poor wireless connectivity.

Euronews is no longer accessible on Internet Explorer. This browser is not updated by Microsoft and does not support the last technical evolutions. We encourage you to use another browser, such as Edge, Safari, Google Chrome or Mozilla Firefox.