Vulnerability Allowed Scraping of 3.5 Billion WhatsApp Accounts

Researchers from the University of Vienna disclosed a novel enumeration technique that could scrape 3.5 billion WhatsApp accounts, with WhatsApp owner Meta rolling out mitigations to prevent exploitation, according to Meta. They generated possible phone number combinations and checked which were registered on the service, effectively enumerating accounts across 245 countries at rates of more than 100 million phone numbers per hour.

The scraped data included timestamps and public keys, enabling inferences about account age, operating system, and the number of linked devices, and for some accounts even profile pictures and about text when made public. Meta said the researchers’ work did not expose non-public data and noted the method exceeded WhatsApp’s intended limits, while stressing the data were securely deleted and that there was no evidence of abuse by malicious actors.

The company highlighted that it has begun mitigations, with first measures rolled out in early September 2025 and additional ones in October, and that the claim of exposing 3.5 billion numbers was not accurate. Written by Eduard Kovacs, November 20, 2025.