Millions of Facebook user records exposed in latest data leak

In the latest major blow to Facebook's reputation, cybersecurity company UpGuard has today revealed that two third-party-developed Facebook app datasets were found exposed to the public on the Internet.

On a blog post on its website, the UpGuard Cyber Risk team said the first lead was from Mexico-based media company Cultura Colectiva.

The 146GB file contained over 540 million records detailing comments, likes, reactions, account names, Facebook IDs, and more, not unlike the data provided in the Cambridge Analytica scandal a year ago.

The blog post also details a separate backup from a Facebook-integrated app titled "At the Pool" exposed to the public internet via an Amazon S3 bucket.

The data covered large swathes of users' Facebook activity, including likes, friends, interests, check-ins, and their passwords for the app in question.

UpGuard reported that each of the data sets was stored in its own Amazon S3 bucket configured to allow public download of files.

Both sets of data were available to third-party developers.

"As Facebook faces scrutiny over its data stewardship practices, they have made effort to reduce third-party access. But as these exposures show, the data genie cannot be put back into the bottle," the statement says.

"Data about Facebook users has been spread far beyond the bounds of what Facebook users can control today.

UpGuard said it contacted Cultura Colectiva about the data leak twice in January but has yet to receive a response.

AWS was then notified of the leak in January and responded three days later saying that the owner of the data had been notified, but the data remained publicly available.

The data was finally secured in April after Bloomberg contacted Facebook for comment.

The data from the second leak via the At the Pool app was taken offline during the time UpGuard was conducting its investigation.

The app in question has been offline since 2014 and the company's website returns a 404 error notice.

"These two situations speak to the inherent problem of mass information collection: the data doesn't naturally go away, and a derelict storage location may or may not be given the attention it requires," UpGuard said in its statement.

"For Cultura Colectiva, data on responses to each post allows them to tune an algorithm for predicting which future content will generate the most traffic.

"The data exposed in each of these sets would not exist without Facebook, yet these data sets are no longer under Facebook's control," UpGuard said.

"In each case, the Facebook platform facilitated the collection of data about individuals and its transfers to third parties, who because responsible for its security.

Facebook most recently came under fire for its lack of response to the Christchurch mosque shootings, when the shooter used Facebook's Live feature to broadcast his massacre in real time.

Although Facebook worked to remove as many copies of the video as possible after it was notified, the social media giant came under fire for violating New Zealand's privacy laws.

"Your silence is an insult to our grief," said New Zealand privacy commissioner John Edwards in a missive to Facebook executives for their lack of engagement and accountability for their part in the incident.