Facebook Marketplace users are at serious risk of phishing, identity theft and cyber attacks as hundreds of thousands of accounts are leaked online.
A major data breach has exposed the phone numbers, email addresses and personal information of 200,000 users.
The dataset, which MailOnline has confirmed is still available, is now being sold to cybercriminals to create targeted scams.
If you use Facebook Marketplace, experts assure you that it’s not too late to protect your personal information.
Jake Moore, global cybersecurity advisor for ESET, told MailOnline: ‘If you think you are being targeted then I would consider changing your password.’
Facebook Marketplace users have been warned to change their passwords and install two-factor authentication after a breach leaked the details of 200,000 accounts
The data was posted on a hacking forum by a known cybercriminal operating under the alias IntelBroker.
In their post, IntelBroker claimed: “In October 2023, a cybercriminal going by the name ‘algoatson’ on Discord breached a contractor managing cloud services for Facebook and stole its partial user database of 200,000 entries.”
The leaked data contained a wide variety of personal information, including names, phone numbers, email addresses, Facebook IDs, and Facebook profile information.
The data has been verified as legitimate by BleepingComputer who could match the email addresses and phone numbers in the sample data.
InfoBroker is an extremely successful and professional hacker or hacker group with a history of targeted breaches against high-profile targets.
Mr Moore said: ‘The infamous InfoBroker has a history of successfully breaking into networks.
“They’ve compromised health data before, so they have no morals or ethics, but they’ve also targeted HP so they’re looking for a lot of money as a result.”
Notorious cybercriminal IntelBroker leaked the database in a message to a hacking forum where they claimed it was stolen in October 2023
He explains that this data would have been sold on the dark web for months for about $1 per line of data.
Mr Moore said: ‘This is a stark reminder that our data is a valuable currency, and the most up-to-date data is the most valuable to criminals.
‘Criminals can do a lot of damage with all the pieces (of information) if they get it all from the dark web.’
Mr Moore told MailOnline that the biggest concern is that this data could be used by cybercriminals to enable targeted attacks.
Of particular concern are the 24,000 email addresses in the dataset that are linked to Facebook pages.
Mr Moore explains that criminals can link these to passwords previously leaked on the dark web and use targeted bots to hijack accounts.
He said: ‘Criminals these days are looking for the opportunity to take over an account, and they can do a lot with that.
“Maybe they just take over a Facebook account to distribute ads, but sometimes they get a little more nefarious and start messaging people from those accounts.”
In the worst case, criminals can use your account to impersonate you and trick your friends and family into sending money.
The leaked phone numbers could also expose Facebook users to an attack called “SIM swapping.”
In these attacks, a criminal calls the mobile phone provider and pretends to be a customer using data collected from leaked data and public social media.
They then convince the provider to transfer the telephone number to a new SIM card.
To see if your accounts have been compromised in the past, you can use sites like Have I Been Pwned, which check leaked databases.
However, these services have not been updated with the details of this breach and therefore cannot notify you of any recent breaches.
Mr Moore recommends that you update your passwords regularly and avoid giving out too much information online that hackers could potentially use against you.
It is also wise to exercise extreme caution when dealing with unusual messages.
“If you receive emails, always think before clicking a link and never reveal information about links that appear in emails and text messages,” Moore added.
Additionally, he recommends setting up two-factor authentication for all your accounts and using a secure authenticator app if possible.
Facebook has been contacted for comment.