The giant social media company Meta has been fined €91 million ($101 million) for inadvertently keeping hundreds of millions of user passwords on its internal systems in plaintext rather than encrypted.
Irish DPC Deputy Commissioner Graham Doyle confirmed the fine in a statement on Friday.
The investigation was started five years ago when Meta informed the Data Protection Commission (DPC) in Ireland that it had some passwords stored in “plaintext.”
At the time, Meta made the issue publicly known, and the DPC stated that no outside parties were given access to the credentials.
As mandated by EU data protection regulations, the Irish regulator sent a draft decision to the other national supervisory bodies in the EU in June 2024. The severity of the punishment was not contested.
For Meta, this is not the first GDPR fine. The business was fined a record €1.2 billion by the Irish regulator in 2023 for “continuing to transfer personal data” of customers from the European Economic Area to the US after an EU-US data transfer agreement was declared unlawful by the EU’s top court because of worries about surveillance.
“It is widely accepted that user passwords should not be stored in plaintext, considering the risks of abuse that arise from persons accessing such data. It must be borne in mind that the passwords the subject of consideration in this case, are particularly sensitive, as they would enable access to users’ social media accounts,” Doyle said in the statement.
According to the firm, hashing and salting are two common cryptographic algorithms used by Facebook to secure user passwords. Why this wasn’t the case for a significant portion of Instagram and Facebook users is unknown.
Although the complete decision outlining the penalties was not made public along with the regulator’s announcement on Friday, the DPC claimed that it had communicated its conclusion with other EU authorities and that none of them had opposed the amount.
We earlier reported that a Kenyan court concluded that Meta could be sued in the East African country for the layoff of dozens of content moderators by a contractor.
