WhatsApp closes loophole that let researchers collect data on 3.5B accounts

WhatsApp, with approximately three billion users, recently faced scrutiny after researchers exploited a flaw in its API, allowing them to identify around 3.5 billion registered accounts, including inactive ones. The researchers from the University of Vienna and SBA Research conducted tests that revealed the API's limits were easily bypassed, enabling them to query over 100 million numbers per hour without facing effective rate-limiting.

This led to the exposure of sensitive data, including profile pictures and personal information, raising privacy concerns. The researchers found millions of accounts in countries where WhatsApp is banned, highlighting the platform's role as a public communication infrastructure without adequate transparency. In response to the findings, WhatsApp has begun implementing stricter rate limits and stated that it is enhancing its anti-scraping measures.