Posted on November 26, 2022 at 5:49 AM
500 Million Scraped WhatsApp Phone Numbers Offered For Sale On The Dark Net
A recent report revealed that a hacker is selling the current mobile phone numbers of almost 500 million WhatsApp users. Security researchers have investigated the data and it has been confirmed to be real WhatsApp numbers.
The report comes one week after a threat actor posted an advertisement on a popular dark net forum. The threat actor claimed that they were offering the 2022 database of 487 million WhatsApp phone numbers for sale.
The dataset purportedly contains WhatsApp user data from 94 countries while the hacker claims that the database also contains more than 32 million records of US users.
The Dataset Contains 32 Million WhatsApp Phone Numbers In The U.S
The threat actors claim there are over 32 million US user records included. The hackers also stated that about 45 million WhatsApp phone numbers belong to users in Egypt, 20 million from Turkey, 20 million from France, 29 million from Saudi Arabia, and 35 million from users in Italy.
Additionally, the dataset for sale contains more than 11 million phone numbers from UK citizens and nearly 10 million Russian phone numbers. The hacker revealed that the dataset is being offered for sale at $2,000 for German phone records, $2,500 for the U.K., records, and $7,000 for the US dataset.
The Phone Numbers Are Active WhatsApp Users
Prospective buyers of the dataset could use such information in the future for smishing and phishing attacks. Researchers have recommended that users remain vigilant for any messages or calls from unknown numbers. It is reported that WhatsApp has over 2 billion global monthly active users.
Cyberbews requested samples of the database and the hacker sent 817 US user numbers, as well as 1097 UK numbers. Upon investigation, it was discovered that the numbers in the sample are current WhatsApp users.
It is still unclear how the data was sourced. While some people’s phone numbers are available to the public, it’s difficult to collect a such a huge amount of phone numbers which are all active WhatsApp numbers. The hackers stated that they “used their strategy to collect the numbers, and all the numbers available in the database are from current active WhatsApp users.
The Dataset Was Probably Scraped From WhatsApp
The seller did not specify how they obtained the database, suggesting they “used their strategy” to collect the data, and assured Cybernews all the numbers in the instance belong to active WhatsApp users.
WhatsApp parent company Meta has been contacted about the development, but there was no immediate response.
The information available on WhatsApp, including phone numbers, can be obtained by a process called scrapping, which is harvesting information on a scale. This process violates WhatsApp’s Terms of Service.
Meta Has Been Criticized For Porous Third-Party Policy
This development comes when Meta is receiving a series of backlashes for allowing third parties to collect or scrape user data. This saw more than 533 million user records exposed on a dark forum, as threat actors were sharing the dataset practically for free.
A few days after Facebook faced criticisms for a massive Facebook leak, a popular hacker forum was seen offering the dataset of more than 500 million LinkedIn users. As long as there are markets for these leaked phone numbers, threat actors will continue to scrape and find avenues to offer the data for money.
The details could be used for fraud, impersonation, phishing, and simply marketing purposes. Several WhatsApp users have complained of receiving unsolicited ads from different organizations. These users are probably those whose phone numbers were scraped.
Users Have Been Advised To Protect Their Data
Head of Cybernews research team Mantas Sasnauskas, stated that tech giants like Meta should take serious steps to protect users’ data since many people now leave a sizable digital footprint in this age. He urged the companies to take a more stringent approach to penalize those found guilty of violating these terms and conditions. Companies should take a serious approach to prevent threats and stop actors from abusing these platforms from a technical standpoint.
Regular users have also been advised on what they can do to prevent personal data leaks. They are advised to adopt data security practices, which include getting a reliable antivirus program and using a high-quality VPN. They should also follow other common security practices to keep their data safe from scammers.
