Meta fined $101.5 million for 2019 breach involving Facebook passwords

LONDON — Ireland’s Data Protection Commission (DPC) on Friday fined Meta 91 million euros (around $101.5 million) for 2019 breach that exposed hundreds of millions of Facebook passwords.

The Irish regulator announced its final decision following an inquiry into Meta Platforms Ireland Limited (MPIL) which was launched in April 2019, after meta said it had inadvertently stored certain passwords of social media users in ‘plaintext’ on its internal systems (without cryptographic protection or encryption).

“It is widely accepted that user passwords should not be stored in plaintext, considering the risks of abuse that arise from persons accessing such data,” said Graham Doyle, deputy commissioner at the DPC.

“It must be borne in mind, that the passwords the subject of consideration in this case, are particularly sensitive, as they would enable access to users’ social media accounts,” Doyle added.

Meta had published information regarding this incident in March 2019. These passwords were not made available to external parties.

“This decision of the DPC concerns the GDPR principles of integrity and confidentiality. The GDPR requires data controllers to implement appropriate security measures when processing personal data, taking into account factors such as the risks to service users and the nature of the data processing,” said the Irish regulator.

In order to maintain security, data controllers should evaluate the risks inherent in the processing and implement measures to mitigate those risks. This decision emphasises the need to take such measures when storing user passwords, it added.

The penalty is bigger than a 17 million euro fine the DPC placed to Meta in March 2022 over a 2018 security breach.

Meta’s earlier security lapses affected up to 30 million Facebook users compared to the hundreds of millions whose passwords were exposed as a result of its failure to secure passwords in 2019.