More than 267 million Facebook user names and phone numbers have been exposed in a database sitting on the web without any password protection…

If that sounds familiar, that’s because the same thing happened back in September, when more than 400 million records were exposed.

This time, it does at least appear that Facebook wasn’t the guilty party in this privacy breach, at least not directly, as Comparitech reports.

The Facebook user names database was online from at least December 4th to 18th.

The information contained in the database could be used to conduct large-scale SMS spam and phishing campaigns, among other threats to end users.

Diachenko immediately notified the internet service provider managing the IP address of the server so that access could be removed. However, Diachenko says the data was also posted to a hacker forum as a download.

The report says the criminals may have been able to access the data by exploiting a Facebook security hole, or it may have been done by simply scraping data from those who have their Facebook profile set to public.

It’s worth checking that your own profile is set to Friends Only: in the iOS app, tap the hamburger menu bottom-right then Settings > Privacy > Privacy Settings > Check a few important settings.

Diachenko says Facebook’s API could also have a security hole that would allow criminals to access user IDs and phone numbers even after access was restricted.

Another possibility is that the data was stolen without using the Facebook API at all, and instead scraped from publicly visible profile pages.

“Scraping” is a term used to describe a process in which automated bots quickly sift through large numbers of web pages, copying data from each one into a database. It’s difficult for Facebook and other social media sites to prevent scraping because they often cannot tell the difference between a legitimate user and a bot. Scraping is against Facebook’s–and most other social networks’–terms of service.

Many people have their Facebook profile visibility settings set to public, which makes scraping them trivial.

Facebook does seem to keep hitting the headlines for the wrong reasons, most recently after it admitted to accessing user locations even when people have opted out.

Via TNW

Photo: Shutterstock