Facebook security breach: How to protect your account
The incident has affected nearly 50 million users, according to the social media platform.
The Government’s cyber-security watchdog has said it is investigating how the breach of nearly 50 million Facebook accounts might have affected UK users, as it issued advice for members.
The National Cyber Security Centre (NCSC) warned Facebook users to be wary of possible “phishing attacks” – where an attacker poses as a legitimate entity and tricks a user into opening a malicious message, email or text.
This can lead to the installation of malware, freezing of a system through ransomware or theft of sensitive information.
Such information can be used to make purchases, steal funds or facilitate identity theft.
The NCSC said: “Usually, if you are the target of a phishing message, your real name will not be used.
“However, if fraudsters do have your name, people will need to be extra vigilant around any message that purports to be from an organisation they deal with – especially when there are attachments or links which take people to sites asking for more personal information.”
It advised anyone who believes they may have been the victim of cyber crime to contact Action Fraud – the UK’s national fraud and cyber crime reporting centre.
Following the announcement of the breach, Facebook issued guidance on the next steps to take.
– 90 million accounts have been automatically logged out, but no one needs to change their passwords.
– If you are having difficulty logging back in – for example because of a forgotten password – you should visit Facebook’s help centre.
– If you have not been logged out automatically, but want to log out as a precaution, visit the “Security and Login” section which lists all the places you are logged in to Facebook.
– Use the one-click option to log out of Facebook on all PCs and devices you may have accessed it on.
Tyler Moffit, of US based cyber-security firm Webroot, explained the hackers had exploited insecure code to gather access codes.
He said: “These tokens allow attackers into the account as if they had entered the correct credentials, which is very scary.
“Access tokens are the equivalent of digital keys that keep people logged in to Facebook so they don’t need to re-enter their password every time they use the app.”
He said concerned users could always reset their passwords which would reset their access tokens.
He added: “We always recommend users following other basic cyber-security best practices as well, such as disconnecting any unnecessary apps or games in social media platforms, making sure two-factor authentication is enabled and never giving out personal or financial information in your profile or private messenger conversations.”
