Facebook rapidly responds to data breach affecting more than 50M users | Public Relation

Facebook has taken a page from recent crises in its recent response to a
security breach.

On Friday, Facebook revealed that a data leak occurred on Sept. 25, which
affects nearly 50 million accounts.

CNN reported:

The attackers exploited a feature called “View as” that lets users see
their Facebook page the way someone else would. They could then potentially
use it to take over the accounts and use them exactly as if they were the
account holders.

… More than 90 million users were forced to log out of their accounts on
Friday for security reasons. Users do not need to take any additional
security precautions or reset their passwords, said Facebook. All logged
out users will receive a notification about the issue from Facebook.

[FREE GUIDE:
3 things you (probably) didn’t know about crisis communications]

In a Facebook Newsroom post, the platform’s vice president of product management, Guy Rosen, wrote:

People’s privacy and security is incredibly important, and we’re
sorry this happened. It’s why we’ve taken immediate action to secure these
accounts and let users know what happened. There’s no need for anyone to
change their passwords. But people who are having trouble logging back into
Facebook — for example because they’ve forgotten their password — should
visit our Help Center. And if anyone wants to take the precautionary action of logging out of
Facebook, they should visit the “
Security and Login” section in settings. It lists the places people are logged into Facebook
with a one-click option to log out of them all.

In the blog post, Rosen outlined the steps Facebook took—and will take—to
rectify the situation:

Here is the action we have already taken. First, we’ve fixed the
vulnerability and informed law enforcement.

Second, we have reset the access tokens of the almost 50 million accounts
we know were affected to protect their security. We’re also taking the
precautionary step of resetting access tokens for another 40 million
accounts that have been subject to a “View As” look-up in the last year. As
a result, around 90 million people will now have to log back in to
Facebook, or any of their apps that use Facebook Login. After they have
logged back in, people will get a notification at the top of their News
Feed explaining what happened.

Third, we’re temporarily turning off the “View As” feature while we conduct
a thorough security review.

This attack exploited the complex interaction of multiple issues in our
code. It stemmed from a change we made to our video uploading feature in
July 2017, which impacted “View As.” The attackers not only needed to find
this vulnerability and use it to get an access token, they then had to
pivot from that account to others to steal more tokens.

Since we’ve only just started our investigation, we have yet to determine
whether these accounts were misused or any information accessed. We also
don’t know who’s behind these attacks or where they’re based. We’re working
hard to better understand these details — and we will update this post when
we have more information, or if the facts change. In addition, if we find
more affected accounts, we will immediately reset their access tokens.

Curtis Sparrer, principal of Bospar PR and
crisis communications leader, praised Facebook’s crisis response:

Facebook has finally learned from its mistakes in crisis communications.
Instead of waiting months or years to disclose bad news to the public like
they did in the past, Facebook did the right thing and alerted us now. Our
research shows that most Americans expect companies like Facebook to reveal
such breaches in a week’s time and actually reward companies for being
responsive and transparent. We hope to see this trend continue.

A transparent and well-laid-out crisis response can give your organization
a leg up on rebuilding trust with stakeholders—especially if you respond
sooner, rather than later.

Though Facebook’s response time was praised, several crises might require
more rapid communications.

A Bospar and Propeller Insights survey revealed that nearly 35 percent of
U.S. consumers think that 24 hours is too long for organizations to wait
and respond to crises, followed by 29.3 percent of consumers who think that
48 hours is too long.

What do you think of Facebook’s response, PR Daily readers?

(image via)

Copyright: sasha85ru / 123RF Stock Photo