By Jurgita Lapienytė
It began, as these stories often do, not with a bang but with a boast. Almost two months ago, a hacker, posting on a shadowy forum, claimed to have siphoned off 1.2 billion Facebook user records – names, email addresses, phone numbers, birthdays, locations, the digital breadcrumbs of real lives.
The research team at Cybernews set out to verify the claim. They examined a sample of 100,000 unique Facebook user records shared by the attackers, and the data appeared legitimate.
If the hacker’s numbers are even half right, it means hundreds of millions of people could soon find their inboxes flooded with targeted phishing scams, their phone numbers sold to spammers, and their personal details circulating in criminal marketplaces – fuel for identity theft, financial fraud, and years of privacy headaches.
However, Meta’s response was a shrug and a hyperlink: a brief statement, then a redirect to a four-year-old blog post about “combating scraping.” No fresh explanation, no sense of urgency. Just another corporate brush-off, as if the world’s largest social network hadn’t just sprung another leak. It’s as if they don’t even understand what we’re fussing about.
This isn’t a one-off. In 2021, Facebook lost control of data on over 500 million users, and the price was a European slap on the wrist – $266 million. Since then, the leaks have kept coming, each time with the same ritual: denial, deflection, and a vague promise to “do better.”
Why does this keep happening? Because the modern internet runs on APIs – digital pipelines that let apps and services talk to each other, and, too often, let bad actors – in many cases, opportunistic marketists not bothered by ethics or troubled by the notion of privacy – siphon off whatever they please. Facebook’s APIs are gold for anyone with a script and a grudge. In the past few years, many companies – such as LinkedIn, Dell, Duolingo, and DeepSeek – have seen their APIs probed and plundered.
What can criminals do with this data? With a haul this size, they can automate scams at industrial scale. They can impersonate, phish, and defraud with uncanny precision. For the average person, it means a future where your inbox, your phone, and your sense of privacy are under constant siege.
It’s not only criminals who can and will make use of such data. Advertising firms and various data brokers simply blossom on these datasets. With them, our privacy is dead on arrival, as numerous examples show. They don’t even shy away from publicly acknowledging they’re listening to you using your phone just so they could serve you better ads.
We should stop pretending this is a technical inevitability. It’s a choice – a choice to treat user data as a resource to be mined, not a trust to be guarded. It’s a choice to react to breaches with PR instead of prevention.
What would real accountability look like? For starters, transparency: Meta should spell out exactly what was taken, how, and what it’s doing to prevent the next round.
Regulators should stop accepting apologies and start demanding airtight safeguards for APIs and user data, and also impose penalties that actually sting.
And we, as users, should demand tools that put control of our digital lives back in our own hands – because accepting business as usual only guarantees we’ll be the next victims.
Until then, the cycle will repeat. Another breach, another apology, another round of “unprecedented” headlines. The only thing truly unprecedented is our willingness to look away.
ABOUT THE EXPERT
Jurgita Lapienytė is the Editor-in-Chief at Cybernews, where she leads a team of journalists and security experts dedicated to uncovering cyber threats through research, testing, and data-driven reporting. With a career spanning over 15 years, she has reported on major global events, including the 2008 financial crisis and the 2015 Paris terror attacks, and has driven transparency through investigative journalism. A passionate advocate for cybersecurity awareness and women in tech, Jurgita has interviewed leading cybersecurity figures and amplifies underrepresented voices in the industry. Recognized as the Cybersecurity Journalist of the Year and featured in Top Cyber News Magazine’s 40 Under 40 in Cybersecurity, she is a thought leader shaping the conversation around cybersecurity. Jurgita has been quoted internationally – by Metro UK, The Epoch Times, Extra Bladet, Computer Bild, and more. Her team reports on proprietary research highlighted in such outlets as the BBC, Forbes, TechRadar, Daily Mail, Fox News, Yahoo, and much more.
US Department of Education Credential Phishing Campaign Threat Advisory Issued By BforeAI
Posted in Commentary with tags BforAI on July 23, 2025 by itnerdBforeAI has published a new threat advisory in which the U.S. Department of Education is being targeted through a credential phishing campaign via government impersonation.
A phishing campaign is currently targeting the U.S. Department of Education’s G5 grant portal, which is used for managing grants and federal education funding.
Multiple lookalike domains have been observed spoofing the G5 login page in an attempt to harvest login credentials from legitimate users.
These domains attempt to clone or imitate the official G5.gov interface and may be targeting education professionals, grant administrators, or vendors tied to the U.S. Department of Education.
This activity is particularly alarming given the recent Trump Administration announcement of 1,400 layoffs at the Department of Education, which may create confusion and an opportunity for social engineering.
The advisory can be found here.
Leave a comment »