Hacker using Telegram bot to sell Facebook users' data

The bot holds information on more than 500 million Facebook users

A hacker is using a Telegram bot to sell Facebook users' phone numbers, or the Facebook IDs linked with a known phone number.

Alon Gal, co-founder of cybersecurity firm Hudson Rock, who first reported the data breach on Twitter, told Motherboard that the hacker claims to have access to 533 million users' data.

The hack allegedly took advantage of a security vulnerability discovered in Facebook in 2019, which enabled anyone to discover the phone number linked with a Facebook ID or vice-versa.

At that time, the phone numbers of over 419 million Facebook users (initially) were found online in an unsecured online database. The database also included the real name, country and gender of many users.

The company patched the bug when it was discovered, but it appears that somebody was able to access the information, and is now selling users' phone numbers for $20 via a Telegram bot.

"It is very worrying to see a database of that size being sold in cybercrime communities, it harms our privacy severely and will certainly be used for phishing smishing and other fraudulent activities by bad actors," said Alon Gal.

According to Motherboard, the Telegram bot, upon launching, tells users that it can help them in finding the cellular phone numbers of Facebook users.

Users can either enter a Facebook ID to receive the corresponding phone number, or vice versa. After a user enters the data, the bot show initial results in redacted form. If the user decides to make a payment ($20 for one record), it displays the full details. For users buying in bulk, the rate drops to $5,000 for 10,000 records.

The bot claims to contain details of Facebook users from 19 countries, including the USA, UK, Australia, Canada and India.

According to reports, Telegram has not yet blocked the bot, which has been running since at least the 12th January, from selling details of Facebook users on its platform.

Facebook told Motherboard that the database contains old Facebook IDs created before the fix was released in 2019. The company said the bot did not return any results when tested against the newer data.

Despite that, cybersecurity experts see the issue as a big headache for users who may be the victims of the 2019 hack and are still unaware of it.

Malicious actors could target such users in order to obtain confidential information from them for further attacks.

For vulnerable users, the only way to fix the issue is to change their phone number so that hackers can't link their Facebook profile with their phone number or vice versa.