Facebook now says 30 million affected by hack, will notify users

Facebook has finally shared an update on the massive hack that affected millions of accounts.

Of the 50 million thought to be "directly affected," Facebook now says that only 30 million accounts were impacted and 29 million had personal data scraped.

Facebook also confirmed that it will notify those affected by the hack in the "coming days," with a notice that will appear at the top of News Feeds. People can also check whether or not they were affected in Facebook's Help Center right now.

The bad news it Facebook now confirms that 29 million accounts had some personal information lifted by hackers. Here's a description of what was accessed, according to Facebook's VP of Product Management, Guy Rosen:

For 15 million people, attackers accessed two sets of information – name and contact details (phone number, email, or both, depending on what people had on their profiles). For 14 million people, the attackers accessed the same two sets of information, as well as other details people had on their profiles. This included username, gender, locale/language, relationship status, religion, hometown, self-reported current city, birthdate, device types used to access Facebook, education, work, the last 10 places they checked into or were tagged in, website, people or Pages they follow, and the 15 most recent searches. For 1 million people, the attackers did not access any information.

Though Facebook confirms no passwords were compromised in the breach, the sheer amount of personal identifying information scraped by hackers is potentially devastating.

Your phone number, email address, birth date, relationship status, location, and employer details are all pieces of information that potential hackers could and identity thieves could use against you for years to come. (Facebook says it will also warn people affected by the breach to be wary of suspicious emails and phone calls.)

Tweet may have been deleted

During a call with reporters Friday, Rosen said the attack appeared to be unrelated to the upcoming elections. "We have no reason to believe that this specific attack was related to the midterms," he said. Facebook is working with the FBI, the US Federal Trade Commission, the Irish Data Protection Commission, and "other authorities," Rosen noted.

Rosen also confirmed Facebook's previous assessment that there is "no evidence so far" that any data from third-party apps was accessed.

Facebook's new disclosures come two weeks after the social media company first disclosed the "security incident" it said could impact as many as 50 million users. In this case, hackers were able to access so many accounts not through compromised passwords, but by exploiting a vulnerability in Facebook's system in order to gain access to access tokens, the "digital keys" that let you log into Facebook without entering your password each time.

Additional reporting by Jack Morse.