Researchers devised a new enumeration technique that exposed 3.5B WhatsApp profiles

A team of researchers from the University of Vienna disclosed a flaw in WhatsApp that could scrape 3.5 billion accounts, a vulnerability Meta has since patched to block the enumeration technique, according to Meta. The researchers showed that users discover contacts by querying WhatsApp servers with phone numbers, enabling large‑scale enumeration, and they probed over 100 million numbers per hour without being blocked.

They generated plausible mobile numbers for 245 countries, narrowing global candidates to 63 billion, and analysed 3.5 billion WhatsApp accounts, including phone numbers, timestamps, profile pictures, about texts, and E2EE public keys, creating one of the largest ethically studied datasets. The study compared this to the 2021 Facebook scraping, noting that about half of those leaked numbers remain active on WhatsApp, underscoring long‑term exposure.

Meta’s response included downplaying the issue, while mitigations began in early September and additional protections arrived in October, with ongoing implications for contact visibility and data exposure across the platform.