A vast chunk of the personal information of 500 million WhatsApp users allegedly stolen by hackers in November has made its way to the dark web. According to a report from Check Point Research, 360 million phone numbers from 108 countries have been put up for sale.
A post on the hacking forum BreachForums claimed to have the phone numbers of more than 487 million WhatsApp users from 84 countries.
First reported by Cybernews, the post claimed to have 32.31 million phone numbers from the U.S., 11.52 million from the UK, 44.82 million from Egypt, 35.67 million from Italy, 28.80 million from Saudi Arabia, 19.84 million from France, 19.63 million from Turkey, 10 million from Russia, 7.32 million from Australia, 6.16 million from India, and 3.49 million phone numbers from Canada.
Each dataset had a different price tag, with the U.S. one set at $7,000, the UK records for $2,500, the Germany dataset for $2,000, etc.
Check Point Research’s analysisOpens a new window of the huge data records revealed it contains 360 million phone numbers from 108 countries while Cybernews confirmed that at least 817 of the U.S. numbers shared by the seller truly belonged to WhatsApp users.
However, Check Point clarified that it couldn’t trace the numbers to WhatsApp users. Meta, the parent company of the popular messenger, told The Record that there is “no evidence of a data leak from WhatsApp.â€
WhatsApp Phone Number Leak Dataset | Source: Check Point Research
See More: LastPass Suffers Second Major Data Breach in Four Months
Karol Paciorek, a member of The Computer Security Incident Response Team for the Polish financial sector, tweeted that the 5,000 numbers they analyzed were extracted from the 2019 Facebook leak.
„Wyciek†z WhatsApp to nic innego jak numery telefonów pozyskane z „wycieku†Facebook, który miał miejsce w 2019 roku.
Próbka 5000 rekordów danych WhatsApp z Polski jest identyczna w porównaniu do tych, które widzieliśmy już w 2019.
Po lewej dane z fb po prawej WhatsApp. pic.twitter.com/WkOGAoN8IaOpens a new window
— Karol Paciorek (@karol_paciorek) November 29, 2022Opens a new window
Either way, Check Point found that the sale of the huge dataset was live for four days. Now it is being distributed for free between dark web users. And whether or not the 360 million phone numbers are from an older data breach or were obtained from a fresh breach, users should expect a surge in phishing, vishing (voice phishing), or smishing (SMS phishing) attacks.
“With millions of records available to buy, it is highly likely these types of attacks will increase. It is also possible that hackers could access other online services using the phone number, which may have more damaging consequences,†Check Point warned.
The company advised users to
- Avoid clicking links, especially shortened ones, sent from anyone
- Download and set up apps from legitimate websites or app stores
- Never reveal any data to an unknown person
- Do not give remote computer access
- Verify callers before giving sensitive information, even if the caller has your correct data
WhatsApp has more than two billion users. To check if your number was leaked, check on this pageOpens a new window .
Earlier in November, Meta was penalized $275 million by the Irish Data Protection Commission for failing to protect the data of 533 million users.
Let us know if you enjoyed reading this news on LinkedInOpens a new window , TwitterOpens a new window , or FacebookOpens a new window . We would love to hear from you!
Image source: Shutterstock