Researchers claim ‘largest leak ever’ after uncovering WhatsApp enumeration flaw

Researchers in Austria used a flaw in WhatsApp to gather the personal data of more than 3.5 billion users, in what they describe as the “largest data leak in history.” The feature allows users to look up others’ details by inputting phone numbers and can be abused to enumerate data such as phone numbers, names, and sometimes profile images.

By plugging in 63 billion phone numbers generated with a tool built on Google’s libphonenumber, the researchers were able to extract details at a rate of over 100 million accounts per hour. In typical settings, platforms rely on rate limiting to prevent such abuse, but WhatsApp reportedly allowed enumeration at this scale without encountering blocking or effective rate limiting. Read more at The Register.