Facebook Stored Millions of Instagram Users’ Passwords in Plaintext

Facebook late last month revealed that the social media
company mistakenly stored
passwords for “hundreds of millions” of Facebook users in
plaintext, including “tens of thousands” passwords of its Instagram
users as well.

Now it appears that the incident is far worse than first
reported.

Facebook today quietly updated its March press release, adding that
the actual number of affected Instagram users were not in hundreds
of thousands but millions.

These plaintext passwords for millions of Instagram users, along
with millions of Facebook users, were accessible to some of the
Facebook engineers, who according to the company, did not abuse
it.

According to the updated post, Facebook discovered “additional
logs of Instagram passwords” stored in a readable format, but added
that its investigation revealed that the stored passwords were
never “abused or improperly accessed” by any of its employees.

Here’s the full updated statement^[2]
posted by the company:

The latest revelation comes in less than a day after it was
revealed that Facebook had stored up to 1.5 million users’
contact information on its servers, without their consent or
knowledge, since May 2016.
To be on the safer side, The Hacker News recommends you to change
their Facebook and Instagram passwords immediately, even if you
don’t receive any email from Instagram or Facebook.

Also, make sure you have enabled two-factor authentication for
the services.

^[1][3]