WhatsApp’s biggest privacy disaster ever: 3.5 billion profiles exposed

Researchers from the University of Vienna and SBA Research did something pretty astonishing: they were able to retrieve all existing WhatsApp numbers. In fact, they were able to view and analyze an incredible 3.5 billion WhatsApp profiles, making this one of the largest data collection efforts in history.

According to the researchers, all existing WhatsApp profiles were unprotected on the web and they were able to download all phone numbers and their associated profile data. The researchers informed Meta (owner of WhatsApp) about this leak back in September 2024, but Mark Zuckerberg’s company didn’t respond at first. (Incidentally, Meta is being sued by a former WhatsApp security chief!)

Meta’s initial lack of interest is all the more surprising when you consider everything that emerges from this freely accessible data. For example, we can determine how many WhatsApp users there are per country and how they’re distributed between Android and iOS. India has the most WhatsApp users, followed by Indonesia and Brazil.

The association of WhatsApp accounts to certain countries isn’t as harmless as it may sound. In authoritarian states where the use of WhatsApp is banned and/or monitored—such as North Korea, China, and Myanmar—it can be life-threatening for the owners of certain phone numbers if state surveillance bodies can analyze this data.

Sensitive data freely accessible

Around 30 percent of WhatsApp users have entered detailed information about themselves in their WhatsApp profiles, including sexual orientation and/or political views. Some users have even mentioned their drug habits, while others (who are obviously drug dealers) have mentioned their drug supply and operations. Links to Tinder and OnlyFans posted on WhatsApp were also freely accessible.

Some WhatsApp profiles were also registered using email addresses associated with government and military organizations. Many profiles contained photos in which the users can be clearly identified.

In other words, all of this freely accessible WhatsApp data could be used to synthesize full identities complete with phone numbers, photos, preferences, and email addresses. The researchers also found security problems with some public keys of WhatsApp accounts.

What you can do about this

Based on the findings, we recommend that all WhatsApp users keep their profile information as limited as possible and refrain from posting photos in which they can be identified. Also, don’t provide any links to dating profiles or other sites that could be detrimental to you.

The full research paper—entitled “Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy”—is published for free on GitHub.