In August 2019, Facebook experienced a significant data breach that compromised the personal information of over 500 million users. This breach was primarily due to a vulnerability in Facebook's contact importer feature, which allowed attackers to scrape users' phone numbers and associate them with their Facebook profiles. The exposed data included phone numbers, full names, locations, birthdates, bios, and, in some cases, email addresses. Notably, the breach did not involve passwords or financial information. ​,

, The vulnerability exploited in this breach had been present for several years, and researchers had previously reported similar issues to Facebook. Despite these warnings, the company did not implement adequate safeguards to prevent such data scraping. Facebook claimed to have fixed the vulnerability in August 2019, but the breach resurfaced in 2021 when the scraped data was made publicly available on a cybercrime forum. ​,

, The exposure of this data posed significant risks to users, as phone numbers can be used for social engineering attacks, phishing, and other malicious activities. Despite the scale of the breach, Facebook chose not to notify affected users individually, citing the age of the data and the inability to determine which users were impacted. ​,

, In response to the breach, Facebook's parent company, Meta, faced legal challenges. In November 2024, a German court ruled that users affected by the breach were eligible for compensation, even without proof of specific financial losses. The court determined that the loss of control over personal data justified damages, overturning a previous lower court decision.,