Meta Hit with €91 Million Fine for Password Security Breach

The Irish Data Protection Commission (DPC) has levied a substantial fine of €91 million ($102 million) against Meta, the parent company of Facebook, due to a significant lapse in password security. This penalty stems from Meta’s failure to implement necessary safeguards for user passwords and its delay in notifying the DPC about the breach.

The investigation, which commenced in April 2019, was triggered by Meta Ireland’s admission that it had “inadvertently stored certain passwords of social media users” in a format that made them readable within its internal systems. Graham Doyle, head of communications at the DPC, pointed out that storing passwords in plaintext exposes users to serious risks if they fall into the wrong hands.

ALSO READ: Protest Against Poor Governance: Organizers Seek Police Protection for October 1 Demonstration

This breach, occurring in January 2019, affected approximately 36 million Facebook and Instagram users across the European Economic Area, including EU member states, Iceland, Liechtenstein, and Norway. Meta confirmed the incident, stating that some passwords were “temporarily stored in a readable format in our internal data systems.” The company asserted that it took swift action to rectify the error and found no signs of password misuse. Furthermore, Meta emphasized its commitment to transparency by proactively informing the DPC and cooperating throughout the investigative process.