> series: anatomy_of_a_breach —— part: 124 —— target: facebook —— passwords: hundreds_of_millions —— storage: plaintext_in_logs —— accessible_by: 20,000_employees<span class="cursor-blink">_</span>_
On 21 March 2019, Brian Krebs reported — and Facebook confirmed — as Facebook acknowledged in a blog post — that hundreds of millions of passwords for Facebook, Facebook Lite, and Instagram users had been stored in plaintext within internal logging and data storage systems since as early as 2012. The passwords were searchable by approximately 20,000 Facebook employees through internal tools. Facebook's internal investigation found that approximately 2,000 engineers or developers had made approximately 9 million internal queries against the data stores containing plaintext passwords.
Facebook stated that it found no evidence of external compromise or internal misuse of the plaintext passwords — but the disclosure raised fundamental questions about Facebook's internal security practices. Passwords are supposed to be hashed using one-way algorithms (like bcrypt) immediately upon receipt, ensuring that even the service operator cannot read them. Storing passwords in plaintext in logging systems — accessible to thousands of employees for seven years — violated every password security principle documented throughout this series, from Adobe's 3DES catastrophe to LinkedIn's unsalted SHA-1.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe Facebook plaintext passwords incident reinforced a fundamental security principle: passwords must be hashed immediately upon receipt and must never appear in plaintext in any system — including application logs, debug output, error reports, or internal analytics. Our web application testing verifies that sensitive data including passwords is not logged, and that password storage uses appropriate one-way hashing (bcrypt, Argon2).
Cyber Essentials mandates appropriate authentication controls. Our penetration testing identifies plaintext credential exposure in logs and internal systems. Data loss prevention through SOC in a Box detects sensitive data in inappropriate locations. And UK Cyber Defence provides the forensic investigation capability when credential exposure is discovered.
Our <a href="/penetration-testing/web-application">application testing</a> checks for credential exposure in logs. <a href="/cyber-essentials">Cyber Essentials</a> mandates appropriate password management.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call