MyRecon OSINT

← Case Files · The Breach Files

2021 · Social network

Facebook, 2021: 533 million phone numbers that were never "hacked"

Case file · 4 min read · Published 14 September 2026

People affected
533 million users across 106 countries
When it happened
Before September 2019
Made public
Data sold in 2020; published free in April 2021
How they got in
Abuse of the contact importer feature to match bulk phone numbers to profiles
Attributed to
Unknown; the file was eventually posted publicly at no cost
What it cost
€265 million fine from Ireland's Data Protection Commission

What was exposed: Phone numbers · Facebook IDs · Names · Genders · Locations · Relationship statuses · Employers · Some email addresses and dates of birth

On 3 April 2021, a file containing records for 533 million Facebook users across 106 countries was posted on a hacking forum for free. It had been sold privately the year before. Facebook's response was that this was old scraped data, not a breach — and the company was technically correct, which is precisely why the case is interesting.

What the contact importer did

Facebook, like most social networks, offered a contact importer: upload your address book and the service tells you which of your contacts are on Facebook so you can add them. It is a genuinely useful feature, and it works by matching a phone number to a profile.

That matching function is the whole vulnerability. If a system will tell you which profile belongs to a phone number, then someone who submits every possible phone number gets a complete map of numbers to profiles. Attackers did not need to guess intelligently; mobile number ranges are structured and finite, and the importer accepted bulk queries.

This is an enumeration problem, not a hacking one. Nothing was bypassed. Every query was a legitimate, authorised use of a working feature. The failure was in the design: a lookup that is harmless for a hundred contacts is a directory when it is answered a hundred million times, and the feature had no rate limiting, cost, or abuse detection sufficient to notice the difference.

Facebook says it changed the feature in September 2019, after the abuse was identified. The data in the 2021 file predates that fix.

Why "it's only scraping" is the wrong defence

Meta's position was that the information was public profile data and no systems were compromised. Both halves are accurate. It still misses the point, for three reasons.

Aggregation changes the nature of the data. Your name is not secret. Your employer is not secret. Your phone number may be known to hundreds of people. A file in which all three are joined for half a billion people is a different object from any of those facts individually, and it is one nobody consented to.

The phone number is the pivot. A mobile number is the recovery mechanism for email accounts, banks and messaging apps. Tied to a verified real name, it is the raw material for SIM-swap fraud, in which an attacker persuades a mobile operator to move the number to their own SIM and then resets everything that sends codes to it.

Regulators did not accept the distinction either. Ireland's Data Protection Commission fined Meta €265 million in November 2022 — not for failing to stop an intrusion, but for failing to design the feature with data protection built in. Under the GDPR, "the feature worked as intended" is not exculpatory if the intended behaviour foreseeably exposed people's data at scale.

The timeline

  1. Before September 2019 — The contact importer is abused at scale to match phone numbers to profiles.
  2. September 2019 — Facebook says it changed the feature to prevent this use.
  3. 2020 — The resulting dataset is sold privately, including through an automated bot service.
  4. 3 April 2021 — The full file — 533 million records, 106 countries — is published free on a hacking forum.
  5. April 2021 — Meta publishes a statement describing the data as scraped and previously reported; Have I Been Pwned loads the phone numbers.
  6. November 2022 — The Irish Data Protection Commission fines Meta €265 million.

What it changed

Scraping became a compliance category. Before this case, bulk collection of public profile data sat in a grey zone: uncomfortable, but not obviously anyone's regulatory problem. The Irish decision put the obligation on the platform to design against enumeration, and every major network has since added friction to contact-matching, search-by-number and profile-lookup features.

Phone numbers lost their status as a trusted identifier. The security community had been arguing against SMS as a second factor for years on interception and SIM-swap grounds. A free file of half a billion verified number-to-identity mappings made the argument concrete, and accelerated the shift to authenticator apps and passkeys.

"Not a breach" stopped being a useful public statement. It is technically meaningful and rhetorically useless: the person whose number is in the file does not care about the taxonomy. Communications teams learned — slowly — that arguing about the definition reads as evasion regardless of accuracy.

If your number was in it

  1. Set a port-out PIN or account lock with your mobile operator. This is the single control that most reduces SIM-swap risk, it is free, and almost nobody does it.
  2. Move two-factor authentication off SMS wherever an authenticator app, passkey or hardware key is offered — the comparison in practical terms.
  3. Check what your own profiles expose by default. The file was assembled from data people did not realise was queryable — the settings that leak most.
  4. Expect messaging-app targeting. A verified number attached to a real name and employer is what makes a WhatsApp or SMS approach convincing. Treat any unexpected contact claiming to be a person you know as unverified until confirmed by another channel.

Checked against every breach on record, against public breach data only. Your address is not sent to us as a form and is not stored — it is handed straight to the lookup tool in your own browser. See the privacy policy.

Questions people ask

Was Facebook hacked in 2021?

No, and the distinction is real even though it sounds like an excuse. No system was broken into and no password was stolen. The contact importer — a feature that matched phone numbers in your address book to Facebook profiles — was queried at enormous scale with generated numbers instead of real contacts, which turned a convenience feature into a lookup service for the entire user base.

Why does scraped data still matter?

Because the harm to the person is identical. A file that maps your phone number to your real name, employer and location supports SIM-swap attacks, targeted phishing and account recovery abuse regardless of whether it was obtained by intrusion or by abuse of a feature. "Publicly accessible" and "harmless in bulk" are not the same claim.

Can I change a leaked phone number?

You can, and it is disruptive — every account using it for recovery or two-factor codes has to be updated. For most people the better response is to remove the number as a recovery method where an app-based or hardware authenticator is available, and to set a port-out PIN with the mobile operator to make SIM-swapping harder.

Was Facebook fined?

Yes. Ireland's Data Protection Commission fined Meta €265 million in November 2022, finding a failure of data protection by design and by default — that is, a failure to build the feature in a way that anticipated this abuse — rather than a failure to prevent an intrusion.

Sources

Read next

Case files are written from the public record: regulatory findings, court filings, company disclosures and contemporaneous reporting, cited above. Figures are the ones the organisation or its regulator finally settled on, which is often not the number first reported — where that differs, the page says so. Disputed accounts are marked as disputed rather than resolved in either direction.

← All case files Breach archive →