Meta fined $102 million for storing passwords in plain text

The Irish Information Safety Fee (DPC) has slapped Meta with a $101.5 million (€91 million) fantastic after wrapping up an investigation right into a safety breach in 2019, whereby the corporate mistakenly saved customers’ passwords in plain textual content. Meta’s unique announcement solely talked about the way it discovered some consumer passwords saved in plain textual content on its servers in January that 12 months. However a month later, it up to date its announcement to disclose that thousands and thousands of Instagram passwords had been additionally saved in simply readable format.

Whereas Meta did not say what number of accounts had been affected, a senior worker informed Krebs on Safety again then that the incident concerned as much as 600 million passwords. A few of the passwords had been saved in simply readable format within the firm’s servers since 2012. They had been additionally reportedly searchable by over 20,000 Fb staff, although the DPC has clarified in its resolution that they had been at the least not made obtainable to exterior events.

The DPC discovered that Meta violated a number of GDPR guidelines associated to the breach. It decided that the corporate did not “notify the DPC of a private knowledge breach regarding storage of consumer passwords in plaintext” with out undue delay and did not “doc private knowledge breaches regarding the storage of consumer passwords in plaintext.” It additionally stated that Meta violated the GDPR by not utilizing acceptable technical measures to make sure the safety of customers’ passwords towards unauthorized processing.

“It’s extensively accepted that consumer passwords shouldn’t be saved in plaintext, contemplating the dangers of abuse that come up from individuals accessing such knowledge. It have to be borne in thoughts, that the passwords the topic of consideration on this case, are significantly delicate, as they might allow entry to customers’ social media accounts,” DPC’s Deputy Commissioner, Graham Doyle, stated in a press release.

The DPC has additionally given the corporate a reprimand along with the penalty. We could know extra about what which means for Meta precisely when the fee publishes its full closing resolution and different associated data sooner or later.