Meta Fined $102 Million For Storing Passwords in Plain Text

The Irish Data Protection Commission (DPC) has issued a fine to Meta of $101.5 million USD (around $136 million CAD) following a discovery which determined the company mistakenly stored user passwords in plain text.

In 2019, the DPC began an investigation into a security breach within Meta. Originally, Meta announced that only some user passwords were stored in plain text within its servers during that time. However, in February of that year, Meta came forward to reveal that millions of Instagram passwords were stored in plain text, making them easily readable.

According to a report from Engadget, Meta didn’t reveal how many accounts were affected by the security breach. However, a senior employee noted to Krebs on Security at the time that upwards of 600 million passwords were involved. It’s said some of the passwords were stored in the easily readable text format since 2012. Other passwords may have been searchable by over 20,000 Facebook employees. However, the DPC did note that passwords did not make their way into the hands of external parties.

The DPC has determined that Meta was in violation of several GDPR rules. Meta is said to have failed “to “notify the DPC of a personal data breach concerning storage of user passwords in plaintext.” The company is also said to have failed to “document personal data breaches concerning the storage of user passwords in plaintext.”

In a statement, DPC’s Deputy Commissioner, Graham Doyle, says “It is widely accepted that user passwords should not be stored in plaintext, considering the risks of abuse that arise from persons accessing such data. It must be borne in mind, that the passwords the subject of consideration in this case, are particularly sensitive, as they would enable access to users’ social media accounts.”

The DPC is expected to publish its final decision in the future. Meta is expected to be reprimanded ontop of the $101.5 million penalty. What this means for the company moving forward is yet to be determined.