By Jurgita Lapienytė
It began, as these stories often do, not with a bang but with a boast. Almost two months ago, a hacker, posting on a shadowy forum, claimed to have siphoned off 1.2 billion Facebook user records – names, email addresses, phone numbers, birthdays, locations, the digital breadcrumbs of real lives.
The research team at Cybernews set out to verify the claim. They examined a sample of 100,000 unique Facebook user records shared by the attackers, and the data appeared legitimate.
If the hacker’s numbers are even half right, it means hundreds of millions of people could soon find their inboxes flooded with targeted phishing scams, their phone numbers sold to spammers, and their personal details circulating in criminal marketplaces – fuel for identity theft, financial fraud, and years of privacy headaches.
However, Meta’s response was a shrug and a hyperlink: a brief statement, then a redirect to a four-year-old blog post about “combating scraping.” No fresh explanation, no sense of urgency. Just another corporate brush-off, as if the world’s largest social network hadn’t just sprung another leak. It’s as if they don’t even understand what we’re fussing about.
This isn’t a one-off. In 2021, Facebook lost control of data on over 500 million users, and the price was a European slap on the wrist – $266 million. Since then, the leaks have kept coming, each time with the same ritual: denial, deflection, and a vague promise to “do better.”
Why does this keep happening? Because the modern internet runs on APIs – digital pipelines that let apps and services talk to each other, and, too often, let bad actors – in many cases, opportunistic marketists not bothered by ethics or troubled by the notion of privacy – siphon off whatever they please. Facebook’s APIs are gold for anyone with a script and a grudge. In the past few years, many companies – such as LinkedIn, Dell, Duolingo, and DeepSeek – have seen their APIs probed and plundered.
What can criminals do with this data? With a haul this size, they can automate scams at industrial scale. They can impersonate, phish, and defraud with uncanny precision. For the average person, it means a future where your inbox, your phone, and your sense of privacy are under constant siege.
It’s not only criminals who can and will make use of such data. Advertising firms and various data brokers simply blossom on these datasets. With them, our privacy is dead on arrival, as numerous examples show. They don’t even shy away from publicly acknowledging they’re listening to you using your phone just so they could serve you better ads.
We should stop pretending this is a technical inevitability. It’s a choice – a choice to treat user data as a resource to be mined, not a trust to be guarded. It’s a choice to react to breaches with PR instead of prevention.
What would real accountability look like? For starters, transparency: Meta should spell out exactly what was taken, how, and what it’s doing to prevent the next round.
Regulators should stop accepting apologies and start demanding airtight safeguards for APIs and user data, and also impose penalties that actually sting.
And we, as users, should demand tools that put control of our digital lives back in our own hands – because accepting business as usual only guarantees we’ll be the next victims.
Until then, the cycle will repeat. Another breach, another apology, another round of “unprecedented” headlines. The only thing truly unprecedented is our willingness to look away.
ABOUT THE EXPERT
Jurgita Lapienytė is the Editor-in-Chief at Cybernews, where she leads a team of journalists and security experts dedicated to uncovering cyber threats through research, testing, and data-driven reporting. With a career spanning over 15 years, she has reported on major global events, including the 2008 financial crisis and the 2015 Paris terror attacks, and has driven transparency through investigative journalism. A passionate advocate for cybersecurity awareness and women in tech, Jurgita has interviewed leading cybersecurity figures and amplifies underrepresented voices in the industry. Recognized as the Cybersecurity Journalist of the Year and featured in Top Cyber News Magazine’s 40 Under 40 in Cybersecurity, she is a thought leader shaping the conversation around cybersecurity. Jurgita has been quoted internationally – by Metro UK, The Epoch Times, Extra Bladet, Computer Bild, and more. Her team reports on proprietary research highlighted in such outlets as the BBC, Forbes, TechRadar, Daily Mail, Fox News, Yahoo, and much more.
A Weak Password Tanks 158 Year Old Company
Posted in Commentary with tags Hacked on July 22, 2025 by itnerdGetting pwned has its costs. Which is why one should do everything possible not to get pwned.
Too bad KNP which is a transport company in the UK didn’t follow that advice. Because one weak password allowed hackers to not only pwn them, but put this 158 year old company out of business:
KNP director Paul Abbott says he hasn’t told the employee that their compromised password most likely led to the destruction of the company.
“Would you want to know if it was you?” he asks.
And:
In 2023, KNP was running 500 lorries – most under the brand name Knights of Old.
The company said its IT complied with industry standards and it had taken out insurance against cyber-attack.
But a gang of hackers, known as Akira, got into the system leaving staff unable to access any of the data needed to run the business. The only way to get the data back, said the hackers, was to pay.
“If you’re reading this it means the internal infrastructure of your company is fully or partially dead…Let’s keep all the tears and resentment to ourselves and try to build a constructive dialogue,” read the ransom note.
The hackers didn’t name a price, but a specialist ransomware negotiation firm estimated the sum could be as much as £5m. KNP didn’t have that kind of money. In the end all the data was lost, and the company went under.
Darren James, a Senior Product Manager at Specops Software had this to say:
“While high-profile cases make headlines, over 19,000 ransomware attacks hit UK businesses last year, many going unnoticed except by those directly impacted. A common cause? Weak, reused, or already breached passwords.”
“Stronger password policies, continuous breached password scanning, secure self-service resets, and proper service desk verification are simple, cost-effective measures that can dramatically reduce risk. In today’s cyber threat landscape, your first line of defense is still one of the most critical.”
Consider this example a warning to get your house in order. Because it doesn’t take much for a bad actor to kill your company.
Leave a comment »