Facebook security breach: 50 million user accounts affected
Facebook said it discovered a security breach that affects nearly 50 million user accounts. According to the company hackers exploited the 'View As' feature on the service and steps are being taken to fix the security problem.
Hacked Facebook users could be owed as much as 6,000 pounds ($7,800) in compensation as a result of the security breach revealed last week.
Legal experts have told The Sun that damages could run into the "thousands" for anyone affected by the hack — if you can prove you felt distressed.
Last Friday, Facebook revealed that hackers gained access to 50 million accounts.
The breach was possible thanks to several bugs in Facebook's systems, which were exploited by hackers.
It meant that attackers were able to log in as absolutely anyone — and access their profiles, photos, friend lists, and even private messages.
Facebook logged 90 million users out as a safety precaution, but the bugs had been live in the website's code since June 2017.
The Sun spoke to legal experts at U.K. law firm Slater and Gordon, who revealed that affected British citizens could make a claim against Facebook.
Gareth Pope, head of group litigation at the firm, told The Sun that it would be possible to file a "civil claim" under the EU's new GDPR data protection regulations, which came into force earlier this year.
"There are certain rules — one of those is the security principle, which means [Facebook] has to secure your data with appropriate technical and organizational measures," Gareth said.
He said this rule is "nice and wide", and gives Facebook users the best chance of squeezing some cash out of the rogue social network.
"If you have left a laptop on the train without a password then that's not secured data," he explained.
"If you have left open the doors of your system to hackers then you have also not secured your data."
According to Gareth, Article 82 of the GDPR rules lets anybody bring "a claim for compensation against Facebook if they have suffered material or non-material damage".
"That's where you're going to get them on the breach of the law — under GDPR, you've not adhered to the security principle under those laws," he said.
It used to be the case that Facebook users would've had to prove financial loss to get compensation.
But that's no longer true.
"You could say 'hackers gained control of my Facebook account, that has caused me some sort of distress', and that is now enough," he said.
He added that joining up to a group action – rather than taking on Facebook alone – would be wisest too.
"If you act as a group, you're more likely to bring Facebook to the table and take your claims more seriously," Gareth told The Sun.
So how much could you actually get from Facebook?
According to Gareth, the potential compensation from a civil lawsuit "is infinite" – but it's unlikely you'll get millions from billionaire Facebook boss Mark Zuckerberg.
Instead, it's closer to thousands: "When looking at the hack of a social account, I would think that would be several thousands of pounds of damage."
You'll have a better chance of getting more money if something bad actually happened to you after the Facebook hack.
"The court will have to attribute a value to the degree of suffering that you have suffered yourself," Gareth said.
"And so, for example, that could be quite a wide range. If somebody had info taken and nobody knows who took it – and nothing happened – then you could say you felt distress.
"If somebody hacked a business and all sorts of business details and trade secrets, and managed to get financial info, and they lost money, obviously the compensation will be higher."
Gareth admitted his own firm Slater and Gordon would consider taking the case on, but they'd need someone to fund the suit — as hacked users could probably only expect a few thousand pounds in compensation.
"It's certainly something we would look at," he said.
"It's more complex than saying 'yes, it's a winnable' case. We would obviously need to work out how the claim was funded, we'd need a litigation funder.
"We wouldn't expect claimants would want to pay us to run the claim for probably only £4-, 5-, 6,000 worth of compensation.
"We'd also need an insurance policy so clients wouldn't have to pay Facebook's legal costs if we lose."
It's also possible that Facebook might decide to settle the matter out of court – and just pay hacked users a fee.
Facebook is currently worth around 361 billion pounds and employs some of the best legal minds in the world, but Zuck's empire might find a court battle too costly.
"Facebook has essentially unlimited resources — if these claims are probably not tens of thousands [of pounds] then they might be several thousands [of pounds] at least.
"You're gonna start thinking about cost and benefit."
This story originally appeared on The Sun. Read more content from The Sun here.
Get a daily look at what’s developing in science and technology throughout the world.