Researchers claim 'largest leak ever' after uncovering WhatsApp enumeration flaw

Researchers in Austria used a flaw in WhatsApp to gather the personal data of more than 3.5 billion users in what they believe amounts to the "largest data leak in history." The messaging platform allows users to look up others' details by inputting their phone numbers. The feature, which has been part of the platform for …

[elsergiovolador]

University of Vain-a

Calling this “the largest data leak in history” is like a researcher finding a phone book and screaming BREACH. They didn’t hack anything, they just asked WhatsApp “who’s this then?” a few billion times and WhatsApp, behaving exactly as designed, replied “here you go” like an overworked receptionist.

The only scandal is that anyone is pretending this behaviour isn’t fundamental to the product. Rate limits don’t fix the underlying absurdity: if you can type a number, you can query the person attached to it. That’s not a vulnerability, that’s the feature you all signed up for.

And the breathless academic tone doesn’t help. “We confirmed 3.5 billion numbers.” Yes, congratulations, you discovered that WhatsApp is popular and that humans use profile photos. Next week: groundbreaking research reveals water still wet, sky maintains blue streaks.

The real punchline is Meta acting grateful, as if they hadn’t been running a global identity directory for a decade and only just noticed someone looked at it too enthusiastically.

And honestly, if this is what passes for “research” at a modern university, God help us all. Enumerating phone numbers with a library someone else wrote is now worthy of papers, press rounds and responsible disclosure rituals. At this rate, the next PhD breakthrough will be “we discovered you can ring people by pressing the digits in the correct order.”

[Tron]

Re: University of Vain-a

Will we be getting university researchers going round estates trying 3D printed skeleton keys on peoples' doors at night next?

Every car that whizzes past outside is a 'potential harm', but I have not found myself under one yet.

We should be expecting more of uni researchers than this.

[seven of five]

Re: University of Vain-a

to paraphrase the late Sith Lord Darth Vader:

Your lack of imagination is... disappointing.

[Curious]

Re: University of Vain-a

Did you look through the paper? https://github.com/sbaresearch/whatsapp-census

The researchers do analysis of public key reuse, reoccurance and collisions, by country and client dataset gathering from the scraping.

"It contains only one piece of advice for privacy-conscious WhatsApp users: they should reconsider their profile photo and info field."

And that the scraped data can act as a reverse phone-book. profile picture -> mobile number, email, employer, and info that unwitting accountholders might intend only for their contacts.

Meta in 2021 had their spokesperson say...

"Protecting the privacy and security of people's data is fundamental to how our business works," the Meta spokesperson said, adding that the company "cooperated fully" with Ireland's DPC.

"We made changes to our systems during the time in question, including removing the ability to scrape our features in this way using phone numbers," the spokesperson added. "Unauthorised data scraping is unacceptable and against our rules and we will continue working with our peers on this industry challenge."

But the paper lists that it required 8 or so attempts over the course of a year to ger Meta to pay attention and acknowledge findings.

Just because it's easier than bin diving does not mean it's not valuable to know.

"Approximately 30 percent of users have entered something in the “Info” field of their profile, and some reveal a lot: political views, sexual or religious orientation, confessions of drug abuse are found there, as are drug dealers who advertise their product range in this very field. Beyond that, the Vienna researchers found information about the user's workplace, up to hyperlinks to profiles on social networks, on Tinder or OnlyFans. Email addresses were of course included,"

https://www.heise.de/en/news/3-5-Billion-Accounts-Complete-WhatsApp-Directory-Retrieved-and-Evaluated-11083244.html

"The easy accessibility of the photos would therefore have allowed the compilation of a database that, through facial recognition, often leads to the phone number and vice versa. Even profile pictures without faces can be talkative: sometimes car license plates, street signs, or landmarks are depicted."

"The Vienna scientists have found that WhatsApp sometimes reuses keys if you log out of WhatsApp on a phone and then open a new WhatsApp account on the same device with a new phone number. This is a security flaw that Meta is now trying to address."

Also the measures that Whatsapp put in place to discourage future scraping are listed, so can be checked if they disappear in a few years due to inconvenience.

[elsergiovolador]

Re: University of Vain-a

The extra analysis is fine. Nobody said the researchers literally did nothing. Key reuse, profile-info correlation, cross-platform linkage… sure, those are real observations. But the foundation of the whole thing is still the same comic premise: they enumerated a global phone book that Meta built on purpose. That’s not a “breach”, it’s the inevitable side-effect of tying a messaging identity to something as guessable as a phone number.

And that’s the part everyone pretends not to see.

You can bolt on as many paragraphs about profile text, workplace links, or someone’s “info” field accidentally outing their Tinder as you like. It still doesn’t change the fact that the scraping worked because the lookup function exists and always has. Rate limits just decide whether you hoover billions of entries in two days or three months.

As for the university-brand reverence: spare me. If Vain-ya University spends a year prodding WhatsApp with a number generator and filing Jira tickets, then acts shocked when Meta takes ages to respond, that’s not evidence of revolutionary science. That’s evidence of academia discovering what anyone who has ever dealt with a giant platform already knows: nothing happens until you embarrass them publicly.

And the big dramatic headline still boils down to:

“We successfully downloaded a directory that WhatsApp gives to anyone, one number at a time.”

Dress it up however you want, the skeleton is the same.

[Blazde]

Re: University of Vain-a

Meta said themselves the method "exceeded our intended limits".

This is the same company that has had the exact same, and several similar issues with Facebook in the past and claims to have "an External Data Misuse team that consists of more than 100 people dedicated to detecting, investigating and blocking patterns of behavior associated with scraping".

https://about.fb.com/news/2021/05/scraping-by-the-numbers/

To be clear, our first line of defense against unauthorized scraping is to make it as hard as we can for people’s data to be collected at scale. We want people to feel comfortable using our services, with confidence that we protect their information, so we work to limit access to our features by scrapers while enabling people to continue using those features in order to connect and share with others.

But keep insisting it's nothing.

[John Brown (no body)]

Re: University of Vain-a

"Dress it up however you want, the skeleton is the same."

Did you miss "big data" that previously was prohibitive or uneconomic to obtain and mine?

Or the "Right to be Forgotten" laws that were more or less irrelevant when searching newspaper archives meant visiting publishers and/or libraries nation or world wide was the only way to find out if someone had something in their past they'd rather was not "public" years later?

In one respect, you are right regarding WhatsApp in that if someone wants to target you, it's a good place to start once you have their phone number. But the ability to "target" billions at once and then go on fishing expeditions for juicy blackmail fodder is a whole other ball game which Meta and the previous owners should have dealt with a long time ago with scraping mitigations as per Metas own claimed "business ethos", let alone take a year to even respond to the prompts, only reacting after the notification to publish.

[Anonymous Coward]

Re: University of Vain-a

Even better. You've now enabled every person on Wall Street to also be privy to your crime for profit.

[vtcodger]

Re: University of Vain-a

privacy-conscious WhatsApp users

An oxymoron?

[Androgynous Cupboard]

Re: University of Vain-a

That's an incredibly dumb comment.

Consider what you could do with 3 billion phone numbers and email address, 2 billion face images and a reverse image lookup. Want the private contact number for a government minister? Easy.

If you haven't the imagination to see how this could be useful, maybe just sit this conversation out.

[elsergiovolador]

Re: University of Vain-a

You’ve built a whole fantasy scenario to dodge the actual point. Nobody argued that a giant scraped dataset is harmless. The issue is your framing that this dataset magically appeared because of some visionary academic wizardry. It didn’t.

The ability to map a phone number to a name, face and profile text existed the moment WhatsApp tied identity to phone numbers and let anyone perform lookups. Bulk scraping doesn’t create the risk, it just reveals scale that was always structurally there.

Waving around hypotheticals about “government ministers’ private numbers” doesn’t magically upgrade this into Mission Impossible. If a minister is daft enough to stick their number, face and workplace on a public lookup profile because the security briefing bored them, that’s not a zero-day, that’s natural selection. And it still doesn’t change the fact that the “attack vector” you’re dramatising is just the default lookup function doing exactly what it was built to do. Shouting at people for pointing that out isn’t quite the mic-drop you think it is.

[Anonymous Coward]

Re: University of Vain-a

You should see the shit people share on the bot infested data scraping cesspit that is LinkedIn.

Esp.. people a bit vulnerable already that are out of a job for a number of reasons.

[Doctor Syntax]

Re: University of Vain-a

"behaving exactly as designed"

There's a basic assumption in there - that anything approaching design was even considered.

[Anonymous Coward]

Re: University of Vain-a

As someone who used to be quite familiar with the ins-and-outs of Viennese culture, I'd say that locating the issue itself, while perhaps not always cool with places like WhatsApp, isn't in and of itself illegal; HOWEVER, exploiting it repeatedly and enumerating through 8 billion users who were essentially victims of the ersatz researchers (not WhatsApp) kinda sorta is. Either the 'researchers' accept that they sorta kinda committed a crime (and do not publish; this happens, and often isn't really punished) or they should be given (at a minimum) a good, stern talking-to and perhaps be served legal papers (since they've opened WhatsApp to the same).

If this is what passes for *ethics* at a major research university, then god help us all.

[iron]

Re: University of Vain-a

So good ethics would be to do no security research and let Meta continue to shit all over their users and crooks make off with their data?

Downloading one or two records would not convince Meta, they didn't even speak to the researchers till informed they were about to publish. The data was deleted afterwards - that is ethics.

[Anonymous Coward]

Re: University of Vain-a

I’m not actually seeing ‘the crime’ here … more than anything it’s highlighted Meta’s Security posture on this was poor and it’s detection systems lacking.

[O'Reg Inalsin]

Re: University of Vain-a

That data is the rightful private property of Meta Corp. Shareholders. Anothercorp Corp. could monetize that data without paying a penny to Meta Corp. Shareholders. Time for a shareholder lawsuit! Yes, it will lose, but it's the principle that counts!

[Anonymous Coward]

Re: University of Vain-a

The data is the rightful private property of the user

FIFY

WhatsApp does not own the phone number, its PPI of a user.

WhatsApp chose to use phone numbers as the UUID, that does not make it their property.

Meta does not pay attention to security/privacy issues until there’s enough zeroes - showcasing the exact extent of how bad this is is required.

The folks defending meta / Facebook must be drunk - this company sells, leaves open and openly misuse private information, whether it’s willingly given or scraped and shadow profiled from any source they can get their fingers on.

“Proprietary data”… stealing something does not give you proprietary rights over it.

[seldom]

Re: University of Vain-a

Whoosh

[Andrew 99]

Re: University of Vain-a

My UUID (phone number) is used for banks and government dealings. Better than any national id number. I don't even give it out to delivery drivers. Yet Meta thinks of it as "public information".

[BartyFartsLast]

Re: University of Vain-a

Well, yeah, I read the article and I'm not sure how throwing phone numbers at an app designed to use phone numbers as a way to locate and confirm the ID of the owner can be considered a breach.

I guess if it's not rate limited then maybe it's not entirely desirable but this is basically like picking up the phone and dialing random numbers hoping someone will answer "Hi this is Geoff"

[v13]

Re: University of Vain-a

That's partially correct but not fully. WhatsApp should only return the results to authenticated accounts, not to anonymous requests. And for authenticated accounts it should have hard limits on the total entries they can download, and even lower limits on the number of entries they can download in a day. No individual account needs to access 100K contacts, or 1000 contacts in a day.

[David Hicklin]

Re: University of Vain-a

Strange thing is in Settings - Privacy you can set who can see things like profile photo and about info

Default is Everybody I think although most of mine are either my contacts or nobody - so what is more important to me is if this process they used bypassing those settings ? If yes then it is a breach, if those settings defeat the feature then it is a feature which is easily defeated.

[Roland6]

Re: University of Vain-a

The same is true for: LinkedIn, Forums et al. Ie. any service that offers a user the facility to set up a public profile.

In some respects this “breech” analysis has parallels with the analysis of password breeches, specifically it reveals typical behaviours: I’m asked for a photo so I will upload a picture of myself….

[Snake]

FacePlant

Owned by them, it's expected that they would eventually pwn you.

[heyrick]

Wait, what?

"However, the text included in profiles could, in some cases, reveal additional sensitive information about the user"

The problem here is the lack of effective rate limiting or blocking (because a bot could scrape this just as easily).

The "sensitive information" part is a complete red herring. If people specifically put additional things on their profile, then it ought to come with the expectation that it will be seen. It's hardly a data leak then, is it?

[Brewster's Angle Grinder]

Re: Wait, what?

Who realised this was public? I've just had a heart stopping moment. Fortunately, my details were a first name only and a profile picture of me aged about six. (No subsequent picture has ever looked as good.) No text. No links to other platforms. But it offers those options. I would only want those things shared with someone whom I've entered a reciprocal relationship.

[WolfFan]

Re: Wait, what?

Heh. There's a reason why I use throway accounts for sign-ins to things like El Reg, and, if I had any, which I don't, to ArseBook/What'sNonsense/other anti-social media. The account I used to sign up for El Reg has a nice pic, of a wolf, a very handsome wolf with lots of very big teeth. (I like wolves...) And all PII on that profile are deliberately inaccurate; I have several throw-away emails which I use for various sites, with different profiles, pix, PII, etc. I have a nice little SQL-based database on my iPad which I use to keep track of which profiles say what; the data can be exported to the DBMS on my desktop systems (not Access, Access doesn't run on Macs) and I can mess with it at will. (I have a LOT of throwaways.) My real pic is not even on my various Apple or (soon to die) MS accounts and will NEVER be anywhere near Google accounts if I can prevent it. (My 'personal' MS account has a pic of Commander Adama with Galactia in the background. Commander Adama has the proper attitude towards network security. So say we all.)

[iron]

Re: Wait, what?

Good for you. Do your partner, parents and kids do the same? I doubt it.

And, can you be sure they haven't uploaded a pic of you anywhere? No.

[An_Old_Dog]

Privacy-Betrayed by Friends and Rellies Who are Privacy-Ignorant/Care-Nots

.... a geotagged photo, annotated in a megacorp database, with your real name, because said megacorp implemented such a feature, encouraging its users to use that feature to "conveniently find pictures of friends!"

[Roland6]

Re: Wait, what?

Bet Google has linked your ElReg account with your Google account and other accounts you have accessed via their browser…

[Anonymous Coward]

Re: Wait, what?

My profile pic is a picture (think one of their own options) of what appears to be a bear farting in a hot spring. Whilst in some respects authentic to me, the actual image is probably used by another million or so users; I'm not overly concerned at the leak.

[MrReynolds2U]

Alarming although not surprising

Since Meta didn't notice this scrape happening, it's likely not the first such occurrence. We should expect this dataset to exist in the wild.

What I find worrying is that you could take a public image of someone (potentially from their FB page), use a little face matching tech and extract their phone number from your scraped data.

This would allow a variety of bad things ranging from abusive calls, fake number presentation (calling as that person), through to targeted delivery of malware to a handset.

This feels more serious the general perception. I would not be surprised if this is also potentially a massive breach of GDPR.

[DS999]

Rate limiting won't even stop it

All that does is rate limit how much you can request from one IP or one IP block. If you have nefarious purposes in mind for this you probably have access to a botnet (either one you "own" or know where you can rent one) which could trivially be commanded to try however many numbers per day are permitted and depending on the size of your botnet get the complete "phone book" in a relatively short time.

So in the (very) unlikely scenario this doesn't exist already in the wild, it will pretty soon.

[Blazde]

Excellent Work

20 pages of academic paper to send to relatives when they ask why anyone would refuse to use WhatsApp when it's "really easy" and "free".

As a bonus several pages of detail that can be sent to anyone about to waste their time engaging with Meta's bug bounty program. Some really shameful responses there. Props to the researchers for persisting with the contact. I would not have had the patience.

[elsergiovolador]

Re: Excellent Work

Imagine telling someone in the 90s that their number is in phone book. Shock and horror.

[Blazde]

Re: Excellent Work

There was actually quite a lot of shock and horror in the 90s when phone books first became available in machine readable form on CD.

[Bill Gray]

Re: Excellent Work

Sometime in the early 1990s, a friend of mine purchased a CD-ROM of driver's licence/registration data from the state of Maine. Read a tag number, and you could look up the owner's name and address in the registration data. The licence data would then give you gender [0], date of birth, hair and eye color, etc.

The data fell in the category of 'public information', legally required to be available for the cost of duplication. It was a simpler time. (Though admittedly, it should have been an obviously Bad Idea even back then.)

[0] I'm not being politically correct here. Yes, the column was labelled 'sex' back then, and I started to write that it would "give you sex". Perhaps it's my dirty mind, but to me, that means something different.

[Blazde]

Re: Excellent Work

Presumably they collect that data in advance so the arresting officer doesn't need to risk asking "sex please?" when booking a DUI case

[Anonymous Coward]

Re: Excellent Work

Seen on a COPS video: an officer querying an uncooperative, nominally-female-appearing, drunk and/or high arrestee: "DO YOU HAVE A PENIS?!"

[John Brown (no body)]

Re: Excellent Work

Yes, there was quite a significant prportion of the UK population who suddenly went ex-directory. I would imagine similar happened in many countries at that time. Probably a case of locking the stable door, but with various number changes over the years, those old CD based directories are likely fairly useless now, at best allowing someone who has one to narrow down a number to few rather than an individual. (Most parts of the UK had phone numbers made longer by adding a digit or three to the front, and with re-use mean, eg 555123, is now 4555123, but could also be 3555123 and/or a few others, not to mention changes in STD (area) codes.)

[Claptrap314]

Re: Excellent Work

Some folks in Texas took to hanging out across from "Gentlemen's Clubs", taking photos of the tags of the customers, and sending those photos to the home address of the plate..

Fun times, indeed.

[iron]

Re: Excellent Work

Imagine not knowing people used to request to be ex-directory. Laughter and finger pointing.

[IGotOut]

Re: Excellent Work

"Imagine telling someone in the 90s that their number is in phone book. Shock and horror."

Imagine that person having enough books to contain 3.5 billion numbers, then the ability to reverse lookup all those numbers in the time it took him to get past aardvark.

[Roland6]

Re: Excellent Work

192.com ?

Remember when it first launched an account wasn’t necessary to do a free reverse lookup…

[Casca]

Re: Excellent Work

Ah yes, thats exactly the same...

[Anonymous Coward]

WhatAbout WhatsApp ForBusiness?

Does this mean they know who "Michael from Microsoft" is?

[JT_3K]

Re: WhatAbout WhatsApp ForBusiness?

Are you sure you're not getting confused with Michaelsoft Binbows?

[DS999]

Seems a certainty this announcement (Oct 21 2025) is related

https://several.com/news/whatsapp-is-finally-ditching-phone-numbers-for-usernames

Likely too little too late though, since these researchers probably aren't the first to do this - just the first to go public with it.

[Anonymous Coward]

You think you are safe because they say you are ?

You can guarantee various friendly and not so friendly governments have already done this and have all your details.

[smalldot]

Re: You think you are safe because they say you are ?

Article mentions countries that ban WhatsApp, such and China and their re-education camps.

I'm pretty sure governments in those countries get a list of WhatsApp users directly from mobile operators. And that includes not just phone number, but name and billing address as well. And real-time location data.

[Claptrap314]

Photos downloaded...

Can we PLEASE do away with face-identification now?

[Anonymous Coward]

Re: Photos downloaded...

Not in the UK.

The Home Office has a fetish for it and believes that living in an open prison is the solution to all their problems.

:/

[rgjnk]

Hmm

I get the security points they were trying to make, but I'm not sure anywhere under testing the data access or the rate limits or anything else required pulling as much of the data at they did.

They pulled *all* the records when pulling 0.1% would still have been more than enough to achieve exactly the same.

What they did just feels unnecessary.

[O'Reg Inalsin]

In Meta we trust

WhatsApp provides optional end-to-end encryption group conversation, doesn't it? I would never imply it's not trustworthy.

[Reginald O.]

You knew this was coming, didn't you?

When Facebook took over, we knew whatever data WhatsApp has, ever had, or ever will have was at risk of loss, diversion, subversion or exploitation.

This looks like the Austrians stumbled on an intelligence agency backdoor, to me, likely one of many.

There are no significant consequences for FB over this loss. Or any of the other big tech players.

Why is that?

[a_foley]

I don't use WhatsApp, so

this means nothing to me!

[John Brown (no body)]

Re: I don't use WhatsApp, so

I guess the down voters didn't hear the music in the background of your post and go on to sing along with "Oooooh, Viennaaaaaaa" ;-D

[mIVQU#~(p,]

Good on WhatsApp for praising the researchers rather than condemning them or down playing the issue.

[Filippo]

Back when WhatsApp was acquired by Meta, I uninstalled the app from every device I owned*. Then, I followed the procedure they outline to have my data removed from their registry. Finally, I sent a registered email to WhatsApp asking them to delete all data they had on me, in accordance to GDPR as an EU citizen.

I never got an answer to that email, and people sometimes still tell me "but I sent you this on WhatsApp" when I tell them I never received something they sent me - which means that I'm still on their systems somewhere.

If I was legally inclined, I wonder what I could do with this.

* the reason I did that was that those devices have my business clients' PPI on them, and if an app buries in its T&Cs a line that says "you allow us to harvest phone contacts and do whataver with them", that would put me in violation of GDPR, the penalty for which is potentially crippling. While any app could do that in theory, Meta is the only company that has actually done it for real and whose products I actually used. That makes it radioactive as far as I'm concerned. Following all procedures and sending a registered email legally covers my ass.

[John Brown (no body)]

"If I was legally inclined, I wonder what I could do with this."

Based on the US understanding of GDPR, you probably need to show up in person at a court somewhere in Delaware to try to sue them only to be told, "fuck of foreigner, you can't do anything against an upstanding American business"

[Roland6]

Well, if they strictly complied with your request, they would have had to delete your deletion request email, before they replied and thus would have lost all record of your email address…

[Anonymous Coward]

WhatsApp et al

Privacy destroying tat.

I’d rather pay for my phone calls.

[v13]

Oops

[Anonymous Coward]

What about the data of people who don't use WhatsApp?

What about the data of people who don't use WhatsApp, but who have friends who do?

It's my understanding(?) that one of the grubby (and surely ought to be illegal) things that WhatsApp does is that when a user creates an account WhatsApp data-reaps the entirety of the user's contacts list from their phone, phone numbers, addresses, everything? (And all without the consent of those people whose Personal Data that actually is.)

Given that WhatsApp is from a country (USA) with data protection laws almost infinitely weaker than GDPR (and, sadly, generally corporate and programmer mindsets that are acculturated to that way of thinking, that any data is theirs to do what they like with), I don't imagine that they even then have the decency (and in any sane country, legal obligation) to then delete any uploaded contact data that doesn't correspond to someone who is already a signed-up user already in their DB, but instead probably greedily hang on to it for ever more (again, without any consent whatsoever from the Data Subject).

So, the question is: could this technique have been used to extract the Personal Data contact details of people who don't even use WhatsApp themselves (assuming, with high likelihood, that WhatsApp did indeed stuff that data in the same DB/system)? Even more murky, if so?!!

[smalldot]

The amount of stress this causes..

It's possible bad guys have used this method long time ago. They now know I eat, poop and use WhatsApp. Sometimes simultaneously. I won't sleep well tonight.

[John Brown (no body)]

Re: What about the data of people who don't use WhatsApp?

"So, the question is: could this technique have been used to extract the Personal Data contact details of people who don't even use WhatsApp themselves (assuming, with high likelihood, that WhatsApp did indeed stuff that data in the same DB/system)? Even more murky, if so?!!"

Absolutely yes, they do that. As do Facebook and everyone else. I'm sure you've heard the term "shadow profiles". All the data they collect is kept forever and eventually it all gets connected.