Facebook's contact importer feature was exploited by attackers who abused the tool to enumerate and scrape profile data at scale. The technique allowed them to link phone numbers to individual Facebook accounts, building a detailed dataset covering 481.7 million users across multiple countries. The scraped data was collected before September 2019, when Facebook altered the feature. The dataset later surfaced publicly on a cybercrime forum in 2021, substantially widening its exposure. The exposed records included names, phone numbers, dates of birth, email addresses, employers, genders, geographic locations, and relationship statuses. The combination of phone numbers with identity details is particularly harmful. It enables phishing, impersonation, SIM-swap-adjacent attacks, and highly targeted social engineering. Even without passwords or financial data, this field set is enough to build convincing fraudulent profiles of real people and to correlate their identities across other platforms and data sources. Facebook chose not to notify affected users individually, citing the age of the data and difficulty in identifying specific accounts. In November 2024, a German court ruled that users affected by the breach were entitled to compensation, marking a concrete legal consequence years after the exposure. People whose data was included remain at ongoing risk, as scraped datasets of this kind circulate indefinitely. Anyone who had a Facebook account active before 2019 should treat their phone number and associated profile details as potentially compromised and be alert to unsolicited calls, messages, or account recovery attempts using that information.

Large social-media ecosystems collect user identity, contact details, social graphs, messages, posts, location-linked activity, ad-targeting signals, and business or creator records across multiple services.

More recently, Facebook has continued to evolve inside Meta’s AI-heavy product strategy. Recent official announcements show Meta adding AI features to Facebook products, including creator-growth tools, Marketplace assistance, and profile-related generative features, while Meta more broadly frames 2025 to 2026 as a period of AI-driven product and infrastructure expansion. �