A newly revealed WhatsApp vulnerability has exposed the phone numbers of nearly every user worldwide. Security researchers discovered that a “simple” loophole in the platform’s contact discovery feature allowed them to extract 3.5 billion phone numbers, along with profile photos and other basic details.
The alarm is not only about the scale of the exposure. It is also about the fact that Meta was warned about this exact flaw back in 2017 and failed to deploy the minimal fix required to stop it.
A Feature That Became a Global Weak Point
WhatsApp’s growth has long been supported by an intuitive contact discovery system. Add a phone number, and the app instantly shows whether that person uses the service. Researchers realized that if you repeat this process billions of times with every possible number, the feature can be turned into a massive scraping tool that reveals the cell number and profile details of almost every WhatsApp user on the planet.
A researcher first flagged this loophole in 2017, pointing out that WhatsApp placed no limit on the number of contact checks a user could perform. Eight years later, a team from the University of Vienna proved the flaw was still unpatched.
Billions of Numbers Collected With Ease
The team needed only 30 minutes to gather 30 million US phone numbers. After that, they expanded their method and continued collecting numbers from around the world.
“To the best of our knowledge, this marks the most extensive exposure of phone numbers and related user data ever documented,” said Aljosha Judmayer, one of the researchers involved in the study.
The team responsibly deleted the data and notified Meta. According to the researchers, Meta took roughly six months to implement rate limits that would prevent similar mass scraping attempts in the future.
WhatsApp claims it was already developing anti-scraping protections and says that it has not found any signs that malicious actors exploited the flaw.
Meta’s Response
After publication, a Meta representative shared an official statement:
“We are grateful to the University of Vienna researchers for their responsible partnership and diligence under our Bug Bounty program. This collaboration successfully identified a novel enumeration technique that surpassed our intended limits, allowing the researchers to scrape basic publicly available information. We had already been working on industry-leading anti-scraping systems, and this study was instrumental in confirming the efficacy of these new defenses. The researchers have securely deleted the data collected as part of the study, and we have found no evidence of malicious actors abusing this vector. User messages remained private and secure thanks to WhatsApp’s default end-to-end encryption, and no non-public data was accessible.”
We have helped 20+ companies in industries like Finance, Transportation, Health, Tourism, Events, Education, Sports.
