WhatsApp vulnerability remained unprotected for eight years

WhatsApp is one of the world's most widely used messaging apps. Its ease of use via phone numbers makes the service attractive to billions of people. However, this very feature has exposed a serious vulnerability—a flaw that Meta was aware of as early as 2017, yet it wasn't fixed until eight years later. This case demonstrates how easily critical personal data can be unintentionally exposed.

A security vulnerability in WhatsApp has exposed a total of 3.5 billion phone numbers. Researchers from Austria discovered that the identity of almost all WhatsApp users could be determined using a simple technical trick. The problem was that WhatsApp had not implemented any limits on querying individual phone numbers. This meant that, theoretically, all existing numbers could be systematically tested. According to the researchers involved, the incident would have become the biggest data breach in history if the exploit had fallen into the wrong hands (via Wired ).

How the WhatsApp vulnerability worked

The mechanism behind WhatsApp is simple. A phone number is saved in the address book, and the app automatically checks whether that number has an account. Often, a profile picture, name, or other identifiable information appears. This convenience became the basis for the vulnerability.

The researchers described their approach as a simple exploit. They tested phone numbers on a large scale. Since WhatsApp had no limit on the number of requests at that time, virtually any number could be queried. Each successful response not only confirmed the existence of a WhatsApp account, but in many cases also revealed a profile picture or profile text.

The first 30 million US phone numbers were collected in just half an hour. The process then continued until approximately 3.5 billion records were collected. The participating scientists considered this the most extensive disclosure of phone numbers and associated data ever documented.

Meta was already made aware of the problem in 2017.

What makes this case particularly concerning is that the vulnerability was already reported by an independent security researcher in 2017. The warning was clear: WhatsApp simply needed to implement a rate limit function to prevent mass automated requests. This security measure is considered a basic industry standard.

Eight years later, the Austrian researchers discovered the exact same vulnerability. They used the same approach and collected data on a scale far exceeding what is typically considered a data leak. This reveals just how low the priority for this security flaw must have been internally.

reaction of the researchers and of meta

The researchers at the University of Vienna acted responsibly. They deleted the data after the test and informed Meta. It then took approximately six months for WhatsApp to implement a limit on data transfer rates. Only then was it prevented that the same method could continue to be used on a large scale.

WhatsApp stated that it had already begun working on a solution internally. Furthermore, there was no evidence that the exploit had ever been used by malicious actors. Whether this is actually true is difficult to verify, as such an attack leaves hardly any trace.

Why this incident is important

This case demonstrates how vulnerable even well-known platforms can be to simple yet effective attacks. Phone numbers are sensitive data. They serve as contact information and often as a security feature for login processes. When a service like WhatsApp discloses phone numbers without safeguards, it creates risks of identity theft, targeted attacks, social engineering, and other forms of abuse.

This incident highlights the critical importance of consistently implementing basic security rules. It also demonstrates that users often have little understanding of what data can be accessed in the background and how easily this data can be intercepted under certain circumstances.

What the vulnerability reveals about WhatsApp and Meta

The discovered WhatsApp security vulnerability represents one of the most serious known cases of potential data breach. The exploit was simple, the consequences would have been enormous, and the threat persisted for many years. Researchers prevented worse, but the case highlights the need for greater awareness at Meta when it comes to protecting critical user data. The swift response after the tip-off was important, but it came years too late. The incident serves as a reminder of how crucial it is for global communication services to proactively and diligently address security risks. (Image: Shutterstock / SmartPhotoLab)