The third-party Facebook app developers exposed data in the public domain in two large datasets that contained 540 million users’ records.

SAN FRANCISCO: 

In yet another shocking revelation, US-based cyber security firm UpGuard has found that Facebook app developers left millions of user records, including comments, likes and reactions, exposed on the Amazon Cloud servers.

The third-party Facebook app developers exposed data in the public domain in two large datasets that contained 540 million users’ records.

“One, originating from the Mexico-based media company Cultura Colectiva, weighs in at 146 gigabytes and contains over 540 million records detailing comments, likes, reactions, account names, FB IDs and more,” said UpGuard in a blog post on Wednesday.

“A separate backup from a Facebook-integrated app titled ‘At the Pool’ was also found exposed to the public internet via an Amazon S3 bucket,” said the researchers.

The “At the Pool” discovery is not as large as the Cultura Colectiva dataset, but it contains plaintext (unprotected) passwords for 22,000 users.

“As Facebook faces scrutiny over its data stewardship practices, they have made efforts to reduce third-party access.

“But as these exposures show, the data genie cannot be put back in the bottle. Data about Facebook users has been spread far beyond the bounds of what Facebook can control today,” said UpGuard.

Combine that plenitude of personal data with storage technologies that are often misconfigured for public access and the result is a long tail of data about Facebook users that continues to leak.

A Facebook spokesperson told The Verge that the company’s policies prohibit storing Facebook information in a public database.

“Once alerted to the issue, we worked with Amazon to take down the databases. We are committed to working with the developers on our platform to protect people’s data,” the spokesperson added.

The political consultancy firm Cambridge Analytica also harvested data of 87 million users via a quiz app, leaving Facebook under heavy criticism on how it share user data with third parties.

“In each case, the Facebook platform facilitated the collection of data about individuals and its transfer to third parties, who became responsible for its security,” said UpGuard.