Facebook confirms Instagram, Tinder weren't accessed by hackers after data breach

BENGALURU: Facebook said that its investigation into the hack that was revealed last week has found "no evidence" of third-party apps like Tinder, Instagram, etc being accessed by hackers.

The breach that affected 50 million people, Facebook said on Friday, was by done by exploiting a bug in the 'View As' feature that lets people see what their profile looks like to others. This allowed hackers to steal the "access tokens" which could allow them access to take over any account.

As a precaution, Facebook had expired the "access tokens" of nearly 90 million accounts that had logged users out of their respective accounts. After revoking access, Facebook warned that the stolen token might also affect third party application like Tinder, Instagram etc that use Facebook login.



"We have now analysed our logs for all third-party apps installed or logged in during the attack we discovered last week. That investigation has so far found no evidence that the attackers accessed any apps using Facebook Login," said Guy Rosen, VP of Product Management in a blog post.

Resetting the access tokens was done to make sure the hackers with stolen access tokens do not use it to take over people's Facebook account or other apps that they had logged in via Facebook login. This announcement comes as a breather for frequent users of Facebook single sign-on feature, who had questions about what this attack means for the apps using Facebook Login.

Computer scientist Jason Polakis who had analyzed the single sign-on tool said that this is "great news" because the extent of the attack has been curtailed.

However, the computer scientist expressed concern about the use of SSO.