Hackers Didn't Use Facebook Credentials - Facebook

Facebook Inc stated on Tuesday that investigators have determined that hackers did not access other sites that use the social media site’s single sign-in in a huge cyberattack that the company disclosed last week.

“We analyzed third party access during the time of the attack we have identified. That investigation has found no evidence that the attackers accessed any apps using Facebook Login,” said Guy Rosen, who is a Facebook Vice President overseeing security.

The announcement comes after Facebook last week disclosed the worst-ever security breach, saying attacker had stolen login codes that enabled them to access almost 50 million Facebook accounts.

Facebook’s shares slipped for the third day on Tuesday, shedding 1.9 percent to $159.33.

Rosen had warned on a Friday conference call that the hackers could have also tapped third party websites and apps that enable users to access their accounts using Facebook logins.

Some security experts, which include a former Facebook executive, stated that the company may have painted a dire, worst-case scenario when it disclosed the attack on Friday to ensure compliance with strict new European Union privacy rules, which took effect in late May.

The EU’s General Data Protection Regulation, or GDPR, slaps steep penalties if companies fail to follow rules that include a requirement for companies to disclose breaches within 72 hours of discovery. That is a light window that security experts say does not give probers enough time to determine the impact of the breach.

“Interesting impact of the GDPR 72-hour deadline: companies announcing breaches before investigations are complete,” former senior Facebook Chief Information Security Officer Alex Stamos said.

The result is that “everybody is confused on actual impact, lots of rumors,” he tweeted, adding that “a month later, truth is included in official filing.”

The social media company’s initial warning that the attackers may have accessed external accounts using Facebook Login was alarming because more than 42,000 websites use the service, according to estimates coming from researchers with the University of Illinois in Chicago.

The warnings prompted some sites to roll out their own investigations amid worries that the attack could have a ripple effect across the internet.

UK-based travel site SkyScanner and IKEA Group’s TaskRabbit, which offers home repairs and furniture assembly, said that they would probe the potential impact on their customers.

Ride-hailing service Uber Technologies Inc said that it has closed active sessions using login credential s as it investigated the matter.

HQBroker Review