© 2022 CyberNews - Latest tech news,
product reviews, and analyses.

If you purchase via links on our site, we may receive affiliate commissions.

WhatsApp data leaked - 500 million user records for sale online


Someone is allegedly selling up-to-date mobile phone numbers of nearly 500 million WhatsApp users. A data sample investigated by Cybernews likely confirms this to be true.

On November 16, an actor posted an ad on a well-known hacking community forum, claiming they were selling a 2022 database of 487 million WhatsApp user mobile numbers.

The dataset allegedly contains WhatsApp user data from 84 countries. Threat actor claims there are over 32 million US user records included.

Another huge chunk of phone numbers belongs to the citizens of Egypt (45 million), Italy (35 million), Saudi Arabia (29 million), France (20 million), and Turkey (20 million).

The dataset for sale also allegedly has nearly 10 million Russian and over 11 million UK citizens' phone numbers.

The threat actor told Cybernews they were selling the US dataset for $7,000, the UK – $2,500, and Germany – $2,000.

Such information is mostly used by attackers for smishing and vishing attacks, so we recommend users to remain wary of any calls from unknown numbers, unsolicited calls and messages.

WhatsApp leak ad
Screenshot by Cybernews

WhatsApp is reported to have more than two billion monthly active users globally.

Upon request, the seller of WhatsApp's database shared a sample of data with Cybernews researchers. There were 1097 UK and 817 US user numbers in the shared sample.

Cybernews investigated all the numbers included in the sample and managed to confirm that all of them are, in fact, WhatsApp users.

Leaked phone number sample

The seller did not specify how they obtained the database, suggesting they “used their strategy” to collect the data, and assured Cybernews all the numbers in the instance belong to active WhatsApp users.

Cybernews reached out to WhatsApp’s parent company, Meta, but received no immediate response. We will update the article as soon as we learn more.

The information on WhatsApp users could be obtained by harvesting information at scale, also known as scraping, which violates WhatsApp’s Terms of Service.

This claim is purely speculative. However, quite often, massive data dumps posted online turn out to be obtained by scraping.

WhatsApp leak
WhatsApp users by country. (c) Cybernews

Meta itself, long criticized for letting third parties scrape or collect user data, saw over 533 million user records leaked on a dark forum. The actor was sharing the dataset practically for free.

Days after a massive Facebook data leak made the headlines, an archive containing data purportedly scraped from 500 million LinkedIn profiles had been put for sale on a popular hacker forum.

Leaked phone numbers could be used for marketing purposes, phishing, impersonation, and fraud.

“In this age, we all leave a sizeable digital footprint – and tech giants like Meta should take all precautions and means to safeguard that data,” head of Cybernews research team Mantas Sasnauskas said. “We should ask whether an added clause of 'scraping or platform abuse is not permitted in the Terms and Conditions' is enough. Threat actors don't care about those terms, so companies should take rigorous steps to mitigate threats and prevent platform abuse from a technical standpoint.”

  • To prevent consequences of personal data leaks, such as phishing or malware attacks, regular users should adopt common cybersecurity measures. This includes a reliable antivirus that blocks various cyberthreats, such as TotalAV. And for online privacy, consider looking at the the best VPNs for WhatsApp on the market that encrypt your data. For instance, we recommend NordVPN.

More from Cybernews:

WhatsApp, LinkedIn actively exploited to hijack Facebook Business accounts

Check if your data has been leaked

Five victims lose $10m in a 'pig butchering' scheme

Researchers unveil device that scares sharks away

Bots snatch incorrectly priced Apple MacBook Air laptops

Compromised emails can sometimes lead to bruised faces

Subscribe to our newsletter



Comments

CRAIG Leventhal
CRAIG Leventhal
prefix 2 days ago
Perhaps an update to the app itself that allows users to block any unwanted numbers is the answer.
Kishanu Karmakar
Kishanu Karmakar
prefix 3 days ago
this is not just a part of the news. It's a serious thing that we have to fix and take care of. Such huge data leak is a concern for future issues.
Robert M. Koretsky
Robert M. Koretsky
prefix 3 days ago
Everyone that uses social media, including Google, and hundreds, maybe even thousands of other apps, records are for sale. Why do you think all of those companies are raking in billions?
Salin
Salin
prefix 4 days ago
I keep telling people that what's up was not secured lol. They say, it's "encrypted" oh yeah? May be in motion, what about at rest with your username and phone number? 😆
User
User
prefix 2 days ago
You're totally right, what about people getting access to your account or scraping your phone number, these are the more relevant issues. The "End-to-End" encryption is just a marketing technique in my eyes to fool people to think it's safe and is somewhat a common practice these days anyway. WhatsApp can also still see your messages, if they state they can't it's lies. Reading WhatsApps lawsuits suggest that they can.
Stephane
Stephane
prefix 4 days ago
A VPN or Antivirus wont prevent any data leak.
Cybernews Team
Cybernews Team
prefix 3 days ago
Using a VPN is part of a good cybersecurity hygiene. While it doesn’t prevent leaks and breaches of third parties, it certainly helps prevent data leakage from your personal devices and protects your privacy online. Meanwhile, an antivirus program can protect you from the outcomes of data leaks, such as phishing attacks.
Spencer
Spencer
prefix 6 days ago
Huh? I thought this is easily obtainable? You even said : "massive data dumps posted online turn out to be obtained by scraping." I can guess just from daily use of whatsapp and mobile phone book.

You don't need to hack Whatsapp or Meta. If anyone manage to really hack through the security, they might as well take higher quality information.

For getting whatsapp users using technology, just automate the creation of phone numbers on mobile phones and automate checking if each number has a whatsapp account, or spam send messages. If the whatsapp message went through, or the mobile phone can detect whatsapp account in the phone book, take down their number and whatever display name they use. And suddenly, you now have lots of "recent 2022" and active whatsapp user.

The post said it is updated for 2022 right? So they got 11 months to do this for each country and compile the data. That's it.
Mins
Mins
prefix 5 days ago
The leak happened 1 week ago, not 1 year ago. It says so in the article and you can see it in the attached photo from the leaker forum. And then Cybernews spent a week to figure out if its actually real or just someone pretending to leak stuff. Did you even read the article or just red the headline and started commenting bs?
Leave a Reply

Your email address will not be published. Required fields are marked