Former WhatsApp security boss sues Meta for “systemic cybersecurity failures”

Former WhatsApp security chief Attaullah Baig has filed a federal whistleblower lawsuit in the US District Court for the District of Northern California, alleging that Meta prioritised user growth over security and that the company kept a range of security and privacy flaws hidden.

The suit, which Baig filed after becoming head of WhatsApp security in 2021, claims he uncovered systemic cybersecurity failures that posed serious risks to user data, including a red-team finding that roughly 1,500 engineers had unrestricted access to user data and could move or steal it without detection or an audit trail.

It notes Baig notified superiors from September 2021 that such access likely violated the 2019 FTC Privacy Order, and that he drafted a document urging a data-classification system to shore up security. The complaint alleges the Meta security team falsified security reports to cover up data-exfiltration risks, and that Meta leaders rebuffed protective measures because they would hamper user growth; Meta has denied the accusations.

The filing references the settlement with the Federal Trade Commission, describing violations tied to the FTC order, and cites alarming figures such as roughly 100,000 WhatsApp users hacked daily in 2022, as many as 400,000 locked out daily last year, and about 400 million profiles apparently being scraped daily. According to the Federal Trade Commission, these claims are part of a broader pattern alleged in the whistleblower complaint.