Facebook has reportedly filed a lawsuit against a Ukrainian man accused of collecting information about 178 million of its users and selling it on a marketplace for stolen data.
The Record reports that Facebook filed the lawsuit in the US District Court for the Northern District of California on Oct. 21. The company alleges in the filing that the defendant, Alexander Alexandrovich Solonchenko, abused a Facebook Messenger feature from January 2018 to September 2019 to scrape information about 178 million users from its servers.
The feature in question is called Contact Importer. “Between in and around June 2015 and September 2019,” Facebook says in the filing, “Messenger Contact Importer included a functionality that would return a one-to-one list of any Facebook users that matched phone numbers uploaded from the address book on a user’s mobile device (‘CI matching function’).”
Facebook says that Solonchenko “used a computer program to deliver automated requests to Facebook computers, meanwhile pretending to be multiple Android devices connected to Facebook’s Messenger mobile app,” so he could abuse Contact Importer to collect people’s Facebook IDs and phone numbers. That data was then sold on a well-known crime forum.
This isn’t the first time Contact Importer was identified as the source of personal information about Facebook users. Someone else leaked the names, locations, and phone numbers, among other things, of 533 million people from 106 countries in April. That data was also scraped by abusing Contact Importer, which means the feature enabled at least two large-scale leaks.
Contact Importer was changed several times to combat scraping attempts. Facebook says it “set limits for the number of contacts that could be uploaded through Messenger Contact Importer and the frequency at which those phone numbers could be submitted” in February 2018, and as of September 2019, it “no longer returns one-to-one lists of matched phone numbers.”
Facebook says in the filing that it’s seeking injunctions against Solonchenko to prevent him from accessing its products or selling information gathered from them in addition to “damages in an amount to be determined at trial,” pre- and post-judgment interest, and “all other equitable or legal relief the Court deems just and proper.”
