Anatomy of a Breach

Anatomy of a Breach: Facebook — Hundreds of Millions of Passwords Stored in Searchable Plaintext

> series: anatomy_of_a_breach —— part: 124 —— target: facebook —— passwords: hundreds_of_millions —— storage: plaintext_in_logs —— accessible_by: 20,000_employees<span class="cursor-blink">_</span>_

Hedgehog Security 30 April 2019 11 min read

Hundreds of millions of passwords. In plaintext. In logs. Accessible to 20,000 employees. Since 2012.

On 21 March 2019, Brian Krebs reported — and Facebook confirmed — as Facebook acknowledged in a blog post — that hundreds of millions of passwords for Facebook, Facebook Lite, and Instagram users had been stored in plaintext within internal logging and data storage systems since as early as 2012. The passwords were searchable by approximately 20,000 Facebook employees through internal tools. Facebook's internal investigation found that approximately 2,000 engineers or developers had made approximately 9 million internal queries against the data stores containing plaintext passwords.

Facebook stated that it found no evidence of external compromise or internal misuse of the plaintext passwords — but the disclosure raised fundamental questions about Facebook's internal security practices. Passwords are supposed to be hashed using one-way algorithms (like bcrypt) immediately upon receipt, ensuring that even the service operator cannot read them. Storing passwords in plaintext in logging systems — accessible to thousands of employees for seven years — violated every password security principle documented throughout this series, from Adobe's 3DES catastrophe to LinkedIn's unsalted SHA-1.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Logging systems that should never have seen passwords.

Passwords in Application Logs
The passwords were captured in application logs — a common misconfiguration where debug or error logging inadvertently records sensitive data. Our <a href="/penetration-testing/web-application">web application testing</a> includes log file analysis and sensitive data exposure checks, identifying exactly this type of misconfiguration.
20,000 Employees With Access
Approximately 20,000 employees could query the systems containing plaintext passwords. The principle of least privilege — limiting access to the minimum required for each role — was not applied to these internal data stores. Our <a href="/penetration-testing/infrastructure">internal penetration testing</a> assesses access controls on internal systems.
Seven Years Without Detection
The plaintext password storage had persisted since 2012 — seven years. Routine security audits, code reviews, or internal penetration testing should have identified passwords in log files. <a href="https://www.socinabox.co.uk">SOC in a Box</a> includes data exposure monitoring that detects sensitive data in inappropriate locations.
Three Facebook Incidents in 12 Months
<a href="/blog/anatomy-of-a-breach-cambridge-analytica">Cambridge Analytica</a> (March 2018), <a href="/blog/anatomy-of-a-breach-facebook-access-tokens">access tokens</a> (September 2018), and now plaintext passwords (March 2019) — three major security/privacy incidents within 12 months demonstrated a systemic pattern. For any organisation, multiple incidents in a short period indicates systemic security governance issues, not just individual failures.

Passwords must never appear in logs, dashboards, or internal tools.

The Facebook plaintext passwords incident reinforced a fundamental security principle: passwords must be hashed immediately upon receipt and must never appear in plaintext in any system — including application logs, debug output, error reports, or internal analytics. Our web application testing verifies that sensitive data including passwords is not logged, and that password storage uses appropriate one-way hashing (bcrypt, Argon2).

Cyber Essentials mandates appropriate authentication controls. Our penetration testing identifies plaintext credential exposure in logs and internal systems. Data loss prevention through SOC in a Box detects sensitive data in inappropriate locations. And UK Cyber Defence provides the forensic investigation capability when credential exposure is discovered.


Facebook stored hundreds of millions of passwords in plaintext for seven years. Are your passwords in your logs?

Our <a href="/penetration-testing/web-application">application testing</a> checks for credential exposure in logs. <a href="/cyber-essentials">Cyber Essentials</a> mandates appropriate password management.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles