Anatomy of a Breach

Anatomy of a Breach: Cambridge Analytica — 87 Million Facebook Profiles and the Weaponisation of Personal Data

> series: anatomy_of_a_breach —— part: 111 —— target: facebook_users —— profiles: 87,000,000 —— purpose: political_manipulation<span class="cursor-blink">_</span>_

Hedgehog Security 31 March 2018 14 min read

87 million profiles. Harvested without consent. Used to target voters. By a British company.

In March 2018, The Guardian, The New York Times, and Channel 4 News published investigations revealing that Cambridge Analytica — a British political consulting firm linked to SCL Group — had harvested the personal data of up to 87 million Facebook users without their explicit consent. The data was collected through a personality quiz app called 'thisisyourdigitallife', developed by academic Aleksandr Kogan. While approximately 270,000 people installed the app, Facebook's API at the time allowed the app to harvest data on those users' friends as well — enabling mass collection far beyond the app's direct users.

The harvested data — including likes, interests, demographic information, and personality traits — was used to build psychological profiles of voters, which Cambridge Analytica then used for targeted political advertising during the 2016 US presidential election and, reportedly, the UK's EU referendum. Facebook's share price dropped by $37 billion. CEO Mark Zuckerberg testified before the US Congress and the European Parliament. The UK's ICO fined Facebook £500,000 (the maximum available under pre-GDPR rules) and issued an Enforcement Notice against Cambridge Analytica (which had by then entered administration). The scandal was a catalyst for the global privacy reckoning that GDPR, coming into force two months later, would codify.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

No hacking required. The API gave it away.

Cambridge Analytica was not a traditional breach — no systems were hacked, no vulnerabilities exploited, no malware deployed. The data was collected through Facebook's own API, using permissions that Facebook had granted to app developers. The failure was in Facebook's platform design: allowing apps to harvest data on users' friends without those friends' knowledge or consent, and failing to enforce its own policies on data usage by third-party developers.

Platform APIs as Attack Surfaces
Facebook's API allowed a single app installed by 270,000 people to harvest data on 87 million. The API's over-permissive data access — and Facebook's failure to audit third-party data usage — created the vulnerability. Our <a href="/penetration-testing/api">API penetration testing</a> assesses whether your APIs expose more data than intended, and whether third-party access is appropriately controlled.
Consent Was Not Informed
The 270,000 app users may have consented to share their own data, but their 87 million friends did not consent to having their data harvested. Under GDPR (coming into force two months later), this type of data collection without explicit, informed consent would be clearly unlawful. <a href="/cyber-essentials">Cyber Essentials</a> and GDPR compliance both require that data collection is proportionate and consented.
Data as a Political Weapon
The Cambridge Analytica case proved that personal data can be used for targeted political manipulation — building psychological profiles and serving customised political advertising to influence voting behaviour. This extends the 'data as a weapon' theme from <a href="/blog/anatomy-of-a-breach-ashley-madison">Ashley Madison</a> (personal shame) and the <a href="/blog/anatomy-of-a-breach-dnc-hack">DNC hack</a> (election interference) into a new domain: micro-targeted propaganda.
£500,000 ICO Fine (Pre-GDPR Maximum)
The ICO fined Facebook £500,000 — the maximum available under the Data Protection Act 1998. Under GDPR, the fine could have been up to 4% of global turnover (approximately $1.6 billion based on 2017 revenue). The timing — two months before GDPR enforcement — highlighted the transformative impact the new regulation would have on enforcement capability.

A British company. The UK's ICO. GDPR about to arrive.

Cambridge Analytica was a British company, investigated by the UK's Information Commissioner's Office, and the scandal broke two months before GDPR came into force — making it the defining case study for why stronger data protection regulation was needed. For UK organisations, Cambridge Analytica established that data misuse — even without hacking — can result in regulatory action, reputational destruction, and criminal investigation. The ICO's Elizabeth Denham described the case as demonstrating 'a disturbing disregard for voters' personal privacy.'

Cyber Essentials certification demonstrates baseline security and data protection commitment. Our API penetration testing assesses third-party data access controls. Data loss prevention through SOC in a Box monitors for unauthorised data access and export. And UK Cyber Defence provides the investigative capability when data misuse is suspected.


87 million profiles harvested through an API. How much data can your third-party integrations access?

Our <a href="/penetration-testing/api">API testing</a> assesses third-party data access. <a href="/cyber-essentials">Cyber Essentials</a> certifies baseline controls. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors for data misuse.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles