Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years
Summary: Facebook stored account passwords in plain text and searchable by thousands of employees for as many as 200 million to 600 million users, with archives dating back to 2012, according to a senior Facebook employee cited by KrebsOnSecurity. Access logs showed roughly 2,000 engineers or developers made about nine million internal queries for data elements containing plain text user passwords, and Facebook said it found no indication of abuse and would not require password resets.
Bottom line: Between 200 million and 600 million passwords sat readable by more than 20,000 employees, and the company's position was that no reset was needed because no misuse had been found - a judgment call every security leader should weigh against their own logging and access controls.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026