Meta Fined $102 Million For Storing 600 Million Passwords In Plain Text

Meta has been fined $101.5 million by the Irish Data Protection Commission (DPC) for storing over half a billion user passwords in plain text for years, with some engineers having access to this data for over a decade. The issue, discovered in 2019, predominantly affected non-US users, especially those using Facebook Lite.

Meta Ireland was found guilty of infringing four parts of GDPR, including how it “failed to notify the DPC of a personal data breach concerning storage of user passwords in plain text.” Meta Ireland did report the failure, but only some months after it was discovered. “It is widely accepted that user passwords should not be stored in plaintext, considering the risks of abuse that arise from persons accessing such data,” said Graham Doyle, Deputy Commissioner at the DPC, in a statement about the fine. “It must be borne in mind, that the passwords the subject of consideration in this case, are particularly sensitive, as they would enable access to users’ social media accounts.”

Other than the fine and an official reprimand, the full extent of the DPC’s ruling is yet to be released publicly. The details published so far do not reveal whether the passwords included any of US users as well as ones in Ireland or across the rest of the European Union. It’s most likely that the issue concerns only non-US users, however. That’s because in 2019, Facebook told CNN that the majority of the plain text passwords were for a service called Facebook Lite, which it described as being a cut-down service for areas of the world with slower connectivity.