[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Data Breaches](/category/data-breaches) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Was My Facebook Data Leaked? Find Out in 2 Steps](/blog/was-my-facebook-data-leaked) Publish date October 13, 2026 {x} minute read # Was My Facebook Data Leaked? Find Out in 2 Steps [Get a demo](/contact-sales) [Free trial](/demo) [Scan my domain](https://www.upguard.com/tools/dark-web-scan) [Download the PDF guide](/resources/the-lean-security-teams-playbook-for-dark-web-incident-response) [Free trial](/demo) [Scan my domain](https://www.upguard.com/tools/dark-web-scan) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Greg Pollock](/team/greg-pollock) Director of Research and Insights Greg is a CISA-certified cybersecurity researcher who holds multiple patents for data leak detection. His findings have been featured in The New York Times, Forbes, and Wired. Table of contents Whitepaper The Lean Security Team's Playbook for Dark Web incident Response Free resource ### The Lean Security Team's Playbook for Dark Web incident Response [Download now](/resources/the-lean-security-teams-playbook-for-dark-web-incident-response) The [personal information](https://www.upguard.com/blog/personally-identifiable-information-pii) of over 500 million Facebook users has been published on a hacker forum on the [dark web](https://www.upguard.com/blog/dark-web). To put the impact into perspective, in 2019, the population of the [entire United States was 328.2 million](https://www.google.com/search?q=poulation+of+united+states\&oq=poulation+of+united+states\&aqs=chrome..69i57j0i10l9.3310j0j7\&sourceid=chrome\&ie=UTF-8). This data was stolen in 2019 after a [vulnerability](https://www.upguard.com/blog/vulnerability) in Facebook’s ‘Add Friend” function was exploited. The vulnerability has now been patched, but the victims of the breach have been impacted for the second time after the data was published on the dark web on April 3 where it can be purchased for only $2.19. The leaked Facebook data could include any of the following user information: * Name * Location * Mobile number * Email address * DOB * Occupation ## How to Find Out if Your Facebook Data was Leaked To find out if your Facebook data is included in this breach, search the email address linked to your Facebook account on the website *Have I Been Pwnd? *This search engine indexes all data breaches associated with a specified email address. Here’s how you do it. ### Step 1: Load the [Have I Been Pwned](https://haveibeenpwned.com/) Website. ‍ ### Step 2: Search the Email Address Linked to Your Facebook Account ‍ The search results will list all of the breached accounts linked to your email address and the specific data that was compromised in each breach. That checks one email. To see whether your company domain showed up in dumps or stealer logs, run a [free dark web scan](/tools/dark-web-scan). ## What to Do if Your Facebook Data was Leaked If you’ve been impacted by a breach, whether it was the Facebook breach or any other incident, the first thing you should do is change all account passwords associated with your email, especially if your compromised passwords are unchanged. Passwords are seldomly changed across accounts, so a single breach could give threat actors access to all accounts linked to the impacted email address. To best protect your personal data, you should use a different password for each of your accounts and enable multi-factor authentication. The second important thing to be aware of is that you will likely be targeted in multiple phishing attacks. [In a phishing attack](https://www.upguard.com/blog/phishing), a seemingly innocuous email is sent to an impacted email address. When the recipient clicks on a link in the email, a series of malicious actions are activated which could include, credential theft and even [unsolicited bank account withdrawals](https://www.upguard.com/blog/what-is-clickjacking) if you’re logged into your bank at the time. **IMPORTANT: **If a sender's domain matches the domain name of the represented business, that does not guarantee that the email is not malicious. If a domain does not have the [required security filters in place](https://www.upguard.com/blog/spf), cybercriminals could send fake emails on the business’s behalf. > Before replying to any business email you should always confirm its legitimacy by contacting the business directly either by phone or via a separate new email. Whitepaper The Lean Security Team's Playbook for Dark Web incident Response Free resource ### The Lean Security Team's Playbook for Dark Web incident Response [Download now](/resources/the-lean-security-teams-playbook-for-dark-web-incident-response) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Data Breaches #### [How to Prevent Data Breaches in 2026 (Highly Effective Strategy)](/blog/prevent-data-breaches) Learn how to implement an effective security control strategy for defending against data breaches in 2026. [](/team/edward-kost) [Edward Kost](#) October 26, 2026 Attack Surface Management #### [Attack Surface Management Vendors Compared](/blog/attack-surface-management-vendors-compared) We compared ASM vendors and helped you rate them before agreeing to a POC! [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Attack Surface Management #### [The Blind Spot in Brand Protection: Why App Stores Slip Past Standard Monitoring](/blog/the-blind-spot-in-brand-protection-why-app-stores-slip-past-standard-monitoring) Do Brand Protection Solutions scan the Apple App Store and Google Play? Don't wait to find out. [](/team/lance-turner) [Lance Turner](#) September 22, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)