WhatsApp Worked With Researchers to Fix Critical Bug

Update: Meta has confirmed that the issue has now been resolved after working with the researchers. 

WhatsApp’s huge global reach has always come from how easy it is to find people on the app; you only need their phone number. But that same system also created a major privacy problem. Until very recently, every WhatsApp user’s phone number could be collected by anyone, including hackers, without needing to break into the platform.

Austrian researchers have revealed that they managed to gather phone numbers of all 3.5 billion WhatsApp users. They also found that for 57% of those users, profile photos were visible, and for 29%, the text on their profiles could be seen.

How Did it Happen?

The process did not involve any hacking tricks. The researchers simply added phone numbers through WhatsApp Web in the same way a normal user would. When a number is entered, WhatsApp confirms whether it belongs to an active account and shows the profile photo and status text if they are public.

The researchers repeated this process on a massive scale, checking about 100 million phone numbers every hour earlier this year.

This issue was not new. WhatsApp’s parent company, Meta, was first warned about this problem back in 2017, but it had not fixed it. The Austrian team alerted Meta again in April, and by October, Meta added rate limits to stop large-scale data collection. Still, this means that for many years, anyone, including malicious groups, could have easily gathered user data without detection.

Meta responded by saying the exposed information counts as “basic publicly available data.” It also noted that users who set their profile photo or text to private were not affected. The company added that it found no proof that attackers abused this method, and emphasized that no private or sensitive data was accessed by the researchers.