Facebook could be forced to pay YOU £6,000 after ‘disaster’ hack attack that left 50million users exposed
The social network's cybersecurity gaffe could prove very costly for billionaire Zuck and his pals
HACKED Facebook users could be owed as much as £6,000 ($7,800) in compensation as a result of the security breach revealed last week.
Legal experts have told The Sun that damages could run into the "thousands" for anyone affected by the hack – if you can prove you felt distressed.
Last Friday, Facebook revealed that hackers gained access to 50million accounts.
The breach – described as a security "disaster" by experts – was possible thanks to several bugs in Facebook's systems, which were exploited by hackers.
It meant that attackers were able to log in as absolutely anyone – and access their profiles, photos, friend lists, and even private messages.
Facebook logged 90million users out as a safety precaution, but the bugs had been live in the website's code since June 2017.
Brits could claim 'distress' against Facebook over hack
The Sun spoke to legal experts at UK law firm Slater and Gordon, who revealed that affected Brits could make a claim against Facebook.
Gareth Pope, head of group litigation at the firm, told us that it would be possible to file a "civil claim" under the EU's new GDPR data protection regulations, which came into force earlier this year.
"There are certain rules – one of those is the security principle, which means [Facebook] has to secure your data with appropriate technical and organisational measures," Gareth said.
He said this rule is "nice and wide", and gives Facebook users the best chance of squeezing some cash out of the rogue social network.
"If you have left a laptop on the train without a password then that's not secured data," he explained.
"If you have left open the doors of your system to hackers then you have also not secured your data."
According to Gareth, Article 82 of the GDPR rules lets anybody bring "a claim for compensation against Facebook if they have suffered material or non-material damage".
"That's where you're going to get them on the breach of the law – under GDPR, you've not adhered to the security principle under those laws," he said.
It used to be the case that Facebook users would've had to prove financial loss to get compensation.
But that's no longer true.
"You could say 'hackers gained control of my Facebook account, that has caused me some sort of distress', and that is now enough," he said.
He added that joining up to a group action – rather than taking on Facebook alone – would be wisest too.
"If you act as a group, you're more likely to bring Facebook to the table and take your claims more seriously," Gareth told The Sun.
Facebook could be forced to hand out THOUSANDS in compensation
So how much could you actually get from Facebook?
According to Gareth, the potential compensation from a civil lawsuit "is infinite" – but it's unlikely you'll get millions from billionaire Facebook boss Mark Zuckerberg.
Instead, it's closer to thousands: "When looking at the hack of a social account, I would think that would be several thousands of pounds of damage."
You'll have a better chance of getting more money if something bad actually happened to you after the Facebook hack.
"The court will have to attribute a value to the degree of suffering that you have suffered yourself," Gareth said.
"And so, for example, that could be quite a wide range. If somebody had info taken and nobody knows who took it – and nothing happened – then you could say you felt distress.
"If somebody hacked a business and all sorts of business details and trade secrets, and managed to get financial info, and they lost money, obviously the compensation will be higher."
Facebook hack timeline – when did it all happen?
Here's what you need to know...
- The vulnerability in Facebook's code was the result of three separate bugs
- These were created in July 2017, when Facebook created a new video upload functionality
- On September 16, 2018, Facebook discovered unusual activity, which manifested itself as a "spike in users", according to officials
- Facebook then launched an investigation
- On Tuesday, September 25, Facebook uncovered the attack and found the vulnerability
- On Wednesday, September 26, Facebook notified law enforcement
- On Thursday evening – September 27 – Facebook said it fixed the vulnerability
- On Friday evening – September 28 – Facebook disclosed the vulnerability to the public
Gareth admitted his own firm Slater and Gordon would consider taking the case on, but they'd need someone to fund the suit – as hacked users could probably only expect a few thousand pounds in compensation.
"It's certainly something we would look at," he said.
"It's more complex than saying 'yes, it's a winnable' case. We would obviously need to work out how the claim was funded, we'd need a litigation funder.
"We wouldn't expect claimants would want to pay us to run the claim for probably only £4-, 5-, 6,000 worth of compensation.
"We'd also need an insurance policy so clients wouldn't have to pay Facebook's legal costs if we lose."
You might not even need to go to court
It's also possible that Facebook might decide to settle the matter out of court – and just pay hacked users a fee.
Facebook is currently worth around £361billion and employs some of the best legal minds in the world, but Zuck's empire might find a court battle too costly.
"Facebook has essentially unlimited resources – if these claims are probably not tens of thousands [of pounds] then they might be several thousands [of pounds] at least.
"You're gonna start thinking about cost and benefit."
MOST READ IN TECH
Facebook hack – how did this breach happen
Here's how it worked...
- Facebook's systems were compromised through the 'View As' feature
- 'View As' lets you see your profile as another specific user would see it
- The three bugs related specifically to a re-design of the video uploader tool
- When using 'View As', the video uploader tool shouldn't have shown up at all
- But on specific posts encouraging people to post happy birthday greetings, it did show up
- The second bug was that the video uploader incorrectly used Facebook's single sign-on functionality, and generated an access token for the mobile app
- The third bug was that when the video uploader showed up, the access token was generated for not you as the user, but for the user you were looking up
- This was discovered by attackers, who were able to use this system to look up other users and get further tokens
He went on: "They may, as some sort of commercial decision, want to offer some sort of compensation, as a gesture of good will.
"They may compensate these people, and tie that up into a settlement agreement so they're not sued in the future."
We've asked Facebook whether it has any plans to compensate victims of the hack, and will update this story with any response.
Do you think Mark Zuckerberg should give up some of his enormous personal fortune to compensate hacked Facebook users? Let us know in the comments!
We pay for your stories! Do you have a story for The Sun Online news team? Email us at [email protected] or call 0207 782 4368 . We pay for videos too. Click here to upload yours.