Former WhatsApp Security Chief Sues Meta Over Alleged Security Failures
Summary
Former WhatsApp security head Attaullah Baig alleges in a whistleblower lawsuit that Meta ignored data-access, account-takeover and profile-scraping risks. Meta denies the claims and says the Department of Labor dismissed a related complaint.
Key points
- Baig’s lawsuit alleges that about 1,500 WhatsApp engineers had unrestricted access to user data without adequate monitoring or audit trails.
- The complaint alleges that WhatsApp user accounts were hacked at a rate of roughly 100,000 per day in 2022, rising to as many as 400,000 daily account lockouts by 2024.
- Baig estimates that pictures and names from about 400 million user profiles were copied daily, allegedly enabling impersonation scams.
- The lawsuit alleges WhatsApp lacked adequate data inventories, access monitoring and breach detection, and that leaders rejected proposed limits on profile access.
- Meta denies the allegations. WhatsApp says Baig’s claims were broad or duplicative of work already underway and says the Department of Labor dismissed his complaint.
Article Details
- Event Type
- Whistleblower lawsuit alleging systemic cybersecurity and privacy failures at WhatsApp and Meta.
- Impact
- The complaint alleges that excessive employee access and inadequate monitoring exposed user data, that account takeovers affected roughly 100,000 users daily in 2022 and up to 400,000 daily by the prior year, and that profile scraping copied information from about 400 million profiles daily. These are allegations, not established findings; Meta denied them, and WhatsApp said the Department of Labor dismissed Baig’s complaint.
People
Attaullah BaigFiled the whistleblower lawsuit and alleged that, while working at WhatsApp, he identified systemic security and privacy failures. The complaint describes him as the former head of WhatsApp security; WhatsApp disputed his title and characterization of his employment.Jennifer NewsteadMeta general counsel whom Baig allegedly notified in a detailed letter of claimed security and regulatory violations.Mark ZuckerbergMeta CEO whom Baig allegedly notified in a detailed letter of claimed security and regulatory violations.
Vendors
Products
Apple MessagesBaig also allegedly notified superiors that data scraping on the platform was a problem because WhatsApp failed to implement protections that are standard on other messaging platforms, such as Signal and Apple Messages.iMessageBaig also cited the strong protections that iMessage and Signal offer against profile scraping compared to WhatsApp.SignalBaig also allegedly notified superiors that data scraping on the platform was a problem because WhatsApp failed to implement protections that are standard on other messaging platforms, such as Signal and Apple Messages.WhatsAppOver the past year, Meta has blanketed TV screens around the world with commercials touting the privacy of Whatsapp, its encrypted messenger with a monthly user base of 3 billion people.