EU Slaps Meta With Fine Of $263.5 Million For 2018 Security Breach That Affected 29 Million Users

Of the 29 million Facebook accounts affected worldwide, approximately 3 million were located in the EU and European Economic Area.

Meta has stated it plans to challenge the ruling and emphasised that it has implemented various measures to safeguard users across its platforms.

Source : Unsplash/Mariia Shalabaieva

Meta has been slapped with a hefty fine of €251 million (equivalent to $263.5 million) by the European Union's data privacy watchdog in Ireland. The penalty stems from a 2018 security breach on Facebook that compromised the personal information of 29 million users. The breach was caused by cyber attackers exploiting a flaw in Facebook's "View As" feature—a tool that enables users to preview how their profile appears to others. This vulnerability resulted in the exposure of a wide range of sensitive personal data, as reported by the Irish Data Protection Commission (DPC).

The compromised information included users' full names, contact details, geographic locations, workplaces, dates of birth, religious affiliations, and gender identities. Alarmingly, the breach also extended to personal data relating to users' children. Meta had promptly informed the DPC of the incident in 2018, but the fine underscores the severity of the breach and the importance of safeguarding user data. 

Reuters quoted DPC Deputy Commissioner Graham Doyle as saying, “By allowing unauthorised exposure of profile information, the vulnerabilities behind this breach caused a grave risk of misuse of these types of data.”

Meta quickly addressed the breach after it was discovered, according to the Data Protection Commission (DPC). Of the 29 million Facebook accounts affected worldwide, approximately 3 million were located in the EU and European Economic Area.

The DPC, serving as the primary EU regulator for many major US internet companies due to their operations in Ireland, has fined Meta nearly 3 billion euros for violations of the General Data Protection Regulation (GDPR) since its implementation in 2018. This includes a record fine of 1.2 billion euros in 2023, which Meta is currently appealing.

Meta To Oppose Ruling

Meta has stated it plans to challenge the ruling from Tuesday and emphasised that it has implemented various measures to safeguard users across its platforms.

Reuters quoted a Meta spokesperson as saying, “We took immediate action to fix the problem as soon as it was identified, and we proactively informed people impacted as well as the Irish Data Protection Commission.”