A cyber criminal created a bot that sold access to the cell phone numbers of millions of Facebook users through the Telegram messaging app, a new report says.
The bot pulled the information from a massive database of phone numbers pulled from Facebook before the social network fixed a vulnerability in 2019, Motherboar said.d.
A Telegram support representative told The Post that the bot was blocked Tuesday morning. But it’s unclear exactly when it was disabled and how long it was active on the platform.
Anyone who retrieved the bot’s Telegram profile could enter the Facebook ID of the person they were looking for and the bot would retrieve the corresponding phone number, the outlet reported Monday. It also reportedly worked the other way around: enter a phone number and the bot would fetch the Facebook ID that matched it.
But there was a catch: the bot initially hid most of the phone number and forced users to pay to see the whole thing, according to the report. Prices reportedly run from $ 20 for a single “credit” to $ 5,000 for 10,000 credits.
The unidentified person who created the bot claimed to have access to phone numbers of 533 million Facebook users in dozens of countries. according to Alon Gal from cybersecurity firm Hudson Rock, who saw it about two weeks ago.
“It is important for Facebook to notify its users of this breach so that they are less likely to fall victim to various hacking and social engineering attempts,” Gal told Motherboard.
Facebook said the data stems from a previous security vulnerability that allowed cyber attackers to associate phone numbers with user profiles using an advanced software code.
“This is old data,” a Facebook spokesperson told The Post in an email. “We found and resolved this issue in August 2019.”
The Telegram bot returned no matches when Facebook tried to compare it with newer user data, the tech giant added.
But that doesn’t help people who linked their phone numbers to their Facebook accounts before the problem was resolved, Motherboard noted. The social network already had more than 1.6 billion daily active users in September 2019.
The bot appeared on Telegram when the encrypted messaging service saw a wave of users amid concerns about Facebook’s privacy policy changes for WhatsApp, its own messaging app. WhatsApp has pushed back the policy rollout.