Meta Faces $101 Million Fine for Storing Facebook Passwords in Plaintext

Meta is facing a $101 million fine for a 2019 incident in which the company discovered it had accidentally stored Facebook passwords in plaintext rather than encrypting them. 

The passwords were stored on internal servers, but as many as 20,000 Facebook employees had access to those servers, potentially allowing them to bypass company protocols and breach user accounts. Meta later found it had also been storing the passwords of millions of Instagram users in plaintext. It publicly disclosed the incident and vowed to improve its security practices. 

Still, Ireland’s Data Protection Commission concluded today that Meta violated the European Union’s GDPR laws on data privacy, which require companies to use appropriate measures to store user passwords. The commission also appears to have faulted the company for failing to notify European regulators about the breach within 72 hours.

It’s unclear why the Irish regulator took so long to reach its decision, but it says it plans to publish the “full Decision and further related information in due course. “

Meta didn’t say whether it’ll pay the fine. But the social network told PCMag it took action to quickly fix the problem after it discovered the passwords being stored in plaintext. 

“As part of a security review in 2019, we found that a subset of FB users’ passwords were temporarily logged in a readable format within our internal data systems. We took immediate action to fix this error, and there is no evidence that these passwords were abused or accessed improperly,” the company says. “We proactively flagged this issue to our lead regulator, the Irish Data Protection Commission, and have engaged constructively with them throughout this inquiry.”