WhatsApp Security Breach Exposes Phone Numbers of 3.5 Billion Users: What You Need to Know in 2025
- How Did the WhatsApp Security Breach Happen?
- What Data Was Exposed?
- Meta’s Response and User Protections
- WhatsApp’s New Multi-Account Feature for iPhone
- Meta’s Legal Win Against the FTC
- FAQs About the WhatsApp Breach
A massive WhatsApp security flaw has left 3.5 billion users vulnerable, exposing phone numbers and profile data since 2017. Researchers uncovered the issue, which Meta only recently acknowledged. Here’s how it happened, what’s at stake, and how to protect yourself—plus, WhatsApp’s new multi-account feature for iPhones and Meta’s legal win against the FTC.
How Did the WhatsApp Security Breach Happen?
Researchers from the University of Vienna discovered a critical vulnerability in WhatsApp’s contact discovery feature, allowing automated systems to scrape phone numbers en masse. Shockingly, this flaw has existed since 2017 but was only publicly acknowledged by Meta in 2025. In just 30 minutes, researchers extracted millions of U.S. numbers, eventually compiling a global dataset of 3.5 billion users. The lack of rate-limiting protections made it alarmingly easy for bad actors to exploit this loophole.
What Data Was Exposed?
The breach didn’t stop at phone numbers. About 57% of users had their profile photos publicly visible, while 29% exposed their "About" text. "If malicious actors had exploited this, it could’ve been one of the largest data leaks in history," noted one researcher. The team deleted all collected data after testing and reported their findings to Meta, which claims no evidence of criminal exploitation.
Meta’s Response and User Protections
Meta stated it’s "actively enhancing protections against large-scale data extraction" and launched WhatsApp Research Proxy, a tool for security researchers to audit the platform’s network protocol. For users, cybersecurity experts advise:
- Set profiles to "private"
- Avoid personal info in the "About" section
- Limit status sharing
- Businesses should use WhatsApp Business API’s secure features
WhatsApp’s New Multi-Account Feature for iPhone
Amid the fallout, WhatsApp is testing a multi-account feature for iOS via TestFlight. Users can now manage multiple accounts (including old WhatsApp Business profiles) on one device, with conversations and preferences syncing automatically. It’s currently in beta for select users.
Meta’s Legal Win Against the FTC
In related news, a U.S. court rejected the FTC’s antitrust case against Meta, filed five years ago during the TRUMP administration. The FTC had sought to force Meta to divest Instagram and WhatsApp, alleging anti-competitive "buy or bury" tactics. The ruling, emailed to NPR, was seen as affirming competition in the social media sector.
FAQs About the WhatsApp Breach
How many users were affected by the WhatsApp breach?
Approximately 3.5 billion WhatsApp users globally had their phone numbers exposed due to this vulnerability.
Can I check if my data was leaked?
Meta hasn’t released a tool for this, but assume your number was exposed if you’ve used WhatsApp since 2017. Update your privacy settings immediately.
Is WhatsApp still safe to use?
End-to-end encryption remains intact for messages, but the breach highlights the importance of adjusting privacy settings. No platform is 100% secure.
