Facebook has been the target of an attack that has endangered 29 million users to varying degrees.
Article updated on October 12th.
Facebook announced the evening of September 28, 2018 have discovered a security breach that potentially affected 50 million accounts - the social network said on October 12, 2018 that the figure was less important in practice: 29 million accounts were affected by l 'attack. The first, with 15 million users, suffered an attack of little importance: the details on the Facebook contact card, including an email or phone number if any.
The group of 14 million users suffered a heavier attack and information such as gender, language, romantic relationship, city of birth or the last 10 tagged places were recovered by the attackers. A last group of one million people was attacked, but the attackers could not take anything in terms of data. No other information was taken, including Messenger conversations, Oculus accounts, WhatsApp data, Instagram etc.
If you were disconnected from your Facebook page on September 28th, it's normal: the social network did it for security reasons. The passwords were not stolen: the attack concerned only the identification tokens.
WHAT HAPPENED ?
Facebook explained that it had discovered a flaw in the "See as" feature that allows you to view your profile as someone else would see it (a stranger, for example). This very handy feature to see information that you leave in public or that you restrict to your friends was diverted and allowed, because of a bug, to take possession of the account. Attackers could therefore use the flaw to steal access tokens and continue to use your account by using them. These tokens are used, for example, to interface your account with an application or website.
The attack is, this time, not only theoretical: Facebook knows that it took place but knows neither the identity of the attackers, nor their country of residence. The investigations are in progress. The security breach has been blocked, according to the security officer of the social network. The authorities have also been informed. The feature named "View As" in English has been completely disabled while a full review of its operation is done.
Finally, the social network has invited its users to go to the Security and connection tab of their account to see where they were connected. It is here that they can also check that everything is in order.
A first version of this article states that you had to change your password. It's not necessary.
