Is WhatsApp's vulnerability compromising the data of 3.5 billion users?
Click to start listening
Synopsis
A recently revealed vulnerability in WhatsApp has put the personal data of around 3.5 billion users at risk. This alarming discovery by researchers from the University of Vienna highlights a significant flaw that allows for large-scale data scraping. Despite prior warnings, the issue remained unaddressed until now, prompting urgent attention from Meta.
Key Takeaways
- A serious vulnerability in WhatsApp exposed data of approximately 3.5 billion users.
- The flaw existed in the contact discovery feature.
- Meta has taken steps to address the issue following its disclosure.
- Researchers gathered data from 245 countries without resistance from servers.
- No malicious exploitation was reported regarding the vulnerability.
New Delhi, Nov 20 (NationPress) A significant security flaw in WhatsApp has reportedly exposed the personal information of approximately 3.5 billion users, according to a research study conducted by the University of Vienna.
The research team identified a flaw within the platform’s contact discovery feature that enabled them to methodically verify every conceivable phone number, thereby identifying active WhatsApp accounts on an extensive scale.
Meta, the parent company of the messaging platform, was notified about the issue and has initiated measures to rectify it.
By employing an automated method, they executed over 100 million queries per hour and ultimately collected information on users spanning 245 countries.
Even though the gathered data was restricted to information available to anyone with a phone number—such as public keys, profile photos, “about” text, and timestamps—the researchers indicated that these elements were sufficient to deduce additional details, including a user’s operating system, duration of platform usage, and the number of linked devices.
The alarming aspect of this discovery is that a similar alert was raised eight years prior. In 2017, a security researcher pointed out the lack of restrictions on the number of phone number checks a user could perform, a vulnerability that facilitated large-scale data scraping.
Notwithstanding this prior alert, the flaw remained unaddressed until the University of Vienna team demonstrated just how easily it could be exploited.
In the initial half-hour of testing, they extracted 30 million U.S. phone numbers and continued gathering data without facing any resistance from the WhatsApp servers.
In a statement to 9to5Mac, Meta acknowledged the researchers' contribution in uncovering the vulnerability and credited them for their role in identifying a new enumeration technique that bypassed its intended protections.
The company affirmed that it had already been developing advanced anti-scraping systems, and the study served to validate the efficacy of these new defenses. Meta also confirmed that the data had been securely deleted by the researchers and stated that there was no evidence of malicious exploitation of the vulnerability.
Point of View
It is crucial to emphasize the need for robust security measures in widely-used platforms like WhatsApp. The recent discovery of a vulnerability that could expose millions of users underscores the importance of staying ahead of potential threats. It is imperative for companies to prioritize user security and act swiftly on identified risks to maintain trust.
NationPress
20/11/2025
Frequently Asked Questions
What was the vulnerability found in WhatsApp?
The vulnerability was related to the contact discovery feature, which allowed researchers to systematically verify phone numbers and identify active accounts.
How many users were affected by this vulnerability?
Approximately 3.5 billion users' personal information was exposed due to this vulnerability.
What kind of data was exposed?
The exposed data included public keys, profile pictures, 'about' text, and timestamps, which could reveal additional insights about users.
What actions has Meta taken regarding this issue?
Meta acknowledged the vulnerability and has initiated steps to strengthen their security measures to prevent similar issues in the future.
Was there any evidence of malicious exploitation?
Meta confirmed that there was no evidence of malicious exploitation of the vulnerability.
