While 65% of adults worldwide have at least one social media account, fewer than 15% understand how their personal data is collected, stored, or protected by these platforms. A new study by cloud network provider Elevate analyzed major apps to identify which ones are putting users’ privacy in the most danger.
The research evaluated each platform using multiple security indicators: confirmed breach incidents, total number of users affected, data sharing policies with third parties, and the number of permissions each app requests from users. Apps were ranked primarily by the total number of users whose data was exposed in confirmed breaches.
Here’s a look at the apps with the worst data breach records:
| App | Number of Confirmed Breaches | Total Users Affected | Permissions requested |
| 5 | ~1.4 billion | 85 | |
| 1 | ~538 million | 107 | |
| X (Twitter) | 2 | ~200 million | 50 |
| 1 | ~70 million | 29 | |
| Telegram | 2 | ~57 million | 21 |
| ChatGPT | 0 | ~20 Million | 0 |
*Although there are no confirmed breaches, ChatGPT reportedly experienced a data leak in 2025.
You can access the complete research findings here.
Facebook ranks first as the platform with the worst data security record. With 3.07B users worldwide, the social media platform has experienced five separate confirmed breaches that collectively exposed data from an estimated 1.4B user accounts. Facebook also demands 85 different permissions from users’ devices and freely shares data with third parties, creating multiple security vulnerabilities.
Weibo takes second place in privacy risks. The Chinese social network suffered a data leak only once, although it affected 538M users, nearly its entire user base of 599M. Weibo also requests a high number of permissions at 107, significantly more than any other platform studied.
X, formerly known as Twitter, has faced data security problems too. The platform experienced two separate breaches that compromised data from roughly 200M accounts, a large portion of its 586M users. Unlike Weibo’s high permission demands, X asks for about 50 app permissions. Still, its policy of sharing user data with third parties may be leaving users vulnerable beyond the breaches themselves.
Pinterest comes in fourth place for data safety risks. The image-sharing platform experienced a single breach affecting 70M users out of its 537 million user base. While Pinterest requests only 29 permissions, it still shares user data with third parties, increasing potential security risks.
Telegram lands in fifth despite its privacy-focused reputation. The app collects 21 permissions and only shares data with third parties when users give consent. However, even with these lighter demands, Telegram has still seen two breaches that exposed around 57M users.
ChatGPT is ranked in sixth position. While not experiencing a confirmed breach, the AI chatbot reportedly had an information leak earlier this year. The incident allegedly resulted in 20M of its accounts being compromised.
FEMA Has Apparently Been Pwned… And Pwned Big
Posted in Commentary with tags Hacked on October 1, 2025 by itnerdIt is being reported that an unidentified hacker stole sensitive data from Customs and Border Protection and Federal Emergency Management Agency employees in a “widespread” breach this summer that lasted several weeks.
Ensar Seker, CISO at SOCRadar had this to say:
“This breach targeting both FEMA and Customs and Border Protection highlights the growing risk of lateral movement across interconnected federal systems, especially when regional network segments are left exposed. A compromise that lasted “several weeks” without detection suggests not just a failure of preventive security controls, but likely gaps in real-time monitoring and behavioral anomaly detection.
The fact that the attacker gained deep access to a FEMA environment that supports critical emergency operations across several states is particularly alarming. This isn’t just a data breach; it’s a breach of trust in systems that Americans rely on during disasters. If the attacker maintained persistence long enough to pivot laterally, they could have exfiltrated sensitive employee PII, internal operational planning data, and potentially even response coordination protocols, all of which could be weaponized in future incidents.
What makes this more concerning is that no threat actor has been named yet. The longer attribution remains unclear, the greater the uncertainty for federal employees, partners, and the public. The incident underscores the urgency for agencies like DHS to implement more robust Zero Trust architectures, extend attack surface visibility into traditionally siloed regional environments, and continuously audit access paths, especially for hybrid or legacy systems.
We’re seeing a rise in state-linked threat actors exploiting weakly segmented infrastructure and federated identities across agencies. This breach is a textbook case of why cybersecurity shouldn’t be managed in operational silos. For federal agencies, the stakes aren’t just reputational or financial. They’re national security.”
Paul Bischoff, Consumer Privacy Advocate at Comparitech:
“A breach that lasts several weeks usually implies that DHS failed to properly secure the data. If the data was left exposed to the internet for that long, then any number of hackers could have found and stolen it in that time. I surmise that hackers exploited the CitrixBleed vulnerability in an unpatched version of the Citrix NetScaler software, which is used for VPNs and other network gateways. CISA, which is also run by the federal government, issued guidance on how to avoid CitrixBleed in 2023.
The big questions we should be asking now is if it’s possible that more than one unauthorized party accessed the data, whether any of them were state-sponsored or political actors, and what data was stolen.”
This is not just bad. It’s insanely bad. The fact that the threat actor was running around for weeks inside a government network should not be a thing. Yet here we are talking about it. This shows that there needs to be a big shake up when it comes to cybersecurity in the US government.
Leave a comment »