Facebook has announced a massive data breach affecting almost 50 million accounts. This breach, the largest in the company’s history, was discovered on September 25 and announced three days later. So far there is little information about the full impact, the motive, who may have been targeted, or whether the data accessed was misused. Here’s what we do know: What Happened Vulnerabilities in Facebook’s code allowed attackers to directly take over user accounts by stealing “access tokens” which are essentially keys to an account. These tokens act as authorization that keeps users logged in to their accounts over time without having to re-enter a password. Facebook discovered the breach because it noticed an unusual spike in users on September 16, prompting investigation. The company has said that the attackers could see everything in a victim’s profile, though there is still no information about the potential misuse of this data. According to CEO Mark Zuckerberg, “So far, our initial investigation has not shown that these tokens were used to access any private messages or posts or to post anything to these accounts, but this, of course, may change as we learn more.” Facebook has stated that passwords and payment information were not compromised. how accounts were accessed This breach was made possible because of three distinct flaws in Facebook’s code that, combined, allowed attackers to see a user’s access token in the page’s HTML. This vulnerability has existed since July 2017 when Facebook implemented new video upload functionality. The “View As” page, normally a read [...]

British Airways is investigating the theft of customer data from its website and app over a two-week period and has urged customers affected to contact their banks or credit card providers. The airline said around 380,000 payment cards had been compromised and it had notified the police. In a statement it said: "The stolen data did not include travel or passport details. From 22.58 (10:58pm) BST August 21, 2018 until 21.45 (9:45pm) BST September 5, 2018 inclusive, the personal and financial details of customers making bookings on ba.com and the airline's app were compromised. The breach has been resolved and our website is working normally.” British Airways has yet to reveal any technical details about the breach, however the type of information compromised makes it likely that the information was skimmed live, as customers booked and paid for flights. The issue was identified when a third party noticed unusual activity and reported it to the airline. This is the first breach to hit a major company since General Data Protection Regulation (GDPR) came into effect on May 25, 2018. GDPR is a regulation on data protection and privacy enacted to protect individuals within the European Union. Fines are levied on violators of GDPR, and British Airways may be liable for $646M if it is determined that the airline did not do enough to protect customer data. Shares of the airlines parent company IAG have dropped in the wake of the announcement. All affected customers have received an email from British Airways, asking them to [...]