Messaging giant WhatsApp has around three billion users in more than 180 countries. Researchers say they were able to identify around 3.5 billion registered WhatsApp accounts thanks to a flaw in the software. That higher number is possible because WhatsApp\u2019s API returns all accounts registered to phone numbers, including inactive, recycled, or abandoned ones, not just active users<\/p>\n
If you\u2019re going to message a WhatsApp user, first you need to be sure that they have an account with the service. WhatsApp lets apps do that by sending a person\u2019s phone number to an application programming interface (API). The API checks whether each number is registered with WhatsApp and returns basic public information<\/p>\n
WhatsApp\u2019s API will tell any program that asks it if a phone number has a WhatsApp account registered to it, because that\u2019s how it identifies its users. But this is only supposed to process small numbers of requests at a time<\/p>\n
In theory, WhatsApp should limit how many of these lookups you can do in a short period, to stop abuse. In practice, researchers at the University of Vienna and security lab SBA Research found that those \u201cintended limits\u201d were easy to blow past<\/p>\n
They generated billions of phone numbers matching valid formats in 245 countries and fired them at WhatsApp\u2019s servers. The contact discovery API replied quickly enough for them to query more than 100 million numbers per hour and confirm over 3.5 billion active accounts<\/p>\n
The team sent around 7,000 queries per second from a single of any decent IT administrator, yet WhatsApp didn\u2019t block the IP or the test accounts, and the researchers say they experienced no effective rate-limiting:<\/p>\n
\n\u201cTo our surprise, neither our IP address nor our accounts have been blocked by WhatsApp. Moreover, we did not experience any prohibitive rate-limiting.\u201d<\/p>\n<\/blockquote>\n
The data exposed goes beyond<\/a> identification of active phone numbers. By checking the numbers against other publicly accessible WhatsApp endpoints, the researchers were able to collect:<\/p>\n
\n
- profile pictures (publicly visible ones)<\/li>\n
- \u201cabout\u201d profile text<\/li>\n
- metadata tied to accounts<\/li>\n<\/ul>\n
Profile photos were available for a large portion of users\u2013roughly two-thirds are in the US region\u2013based on a sample. That raises obvious privacy concerns, especially when combined with modern AI tools. The researchers warned:<\/p>\n
\n\u201cIn the hands of a malicious actor, this data could be used to construct a facial recognition\u2013based lookup service \u2014 effectively a \u2018reverse phone book\u2019 \u2014 where individuals and their related phone numbers and available metadata can be queried based on their face.\u201d<\/p>\n<\/blockquote>\n
The \u201cabout\u201d text, which defaults to \u201cHey there! I\u2019m using WhatsApp,\u201d can also reveal more than intended. Some users include political views, sexual identity or orientation, religious affiliation, or other details considered highly sensitive under GDPR. Others post links to OnlyFans accounts, or work email addresses at sensitive organisations including the military. That\u2019s information intended for contacts, not the entire internet.<\/p>\n
Although ethics rules prevented the team from examining individual people, they did perform higher-level analysis\u2026 and found some striking things. In particular, they found millions of active registered WhatsApp accounts in countries where the service is banned. Their dataset contained:<\/p>\n
\n
- nearly 60 million accounts in Iran before the ban was lifted last Christmas Eve, rising to 67 million afterward<\/li>\n
- 2.3 million accounts in China<\/li>\n
- 1.6 million in Myanmar<\/li>\n
- and even a handful (five) in North Korea<\/li>\n<\/ul>\n
This isn\u2019t Meta\u2019s first time accidentally serving up data on a silver platter. In 2021, 533 million Facebook accounts were publicly leaked after someone scraped them from Facebook\u2019s own contact import feature<\/p>\n
This new project shows how long-lasting the effects of those leaks can be. The researchers at the University of Vienna and SBA Research found that 58% of the phone numbers leaked in the Facebook scrape were still<\/a> active WhatsApp accounts this year. Unlike passwords, phone numbers rarely change, which makes scraped datasets useful to attackers for a long time<\/p>\n
The researchers argue that with billions of users, WhatsApp now functions much like public communication infrastructure but without anything close to the transparency of regulated telecom networks or open internet standards. They wrote<\/p>\n
\n\u201cDue to its current position, WhatsApp inherits a responsibility akin to that of a public telecommunication infrastructure or Internet standard (e.g., email). However, in contrast to core Internet protocols which are governed by openly published RFCs and maintained through collaborative standards \u2014 this platform does not offer the same level of transparency or verifiability to facilitate third-party scrutiny.\u201d<\/p>\n<\/blockquote>\n
So what did Meta do? It began implementing stricter rate limits last month, after the researchers disclosed the issues through Meta\u2019s bug bounty program in April<\/p>\n
In a statement to SBA Research, WhatsApp VP Nitin Gupta said the company was \u201calready working on industry-leading anti-scraping systems.\u201d He added that the scraped data was already publicly available elsewhere, and that message content remained safe thanks to end-to-end encryption<\/p>\n
We were fortunate that this dataset ended up in the hands of researchers\u2014but the obvious question is what would have happened if it hadn\u2019t? Or whether they were truly the first to notice? The paper itself highlights that concern, warning:<\/p>\n
\n\u201cThe fact that we could obtain this data unhindered allows for the possibility that others may have already done so as well.\u201d<\/p>\n<\/blockquote>\n
For people living under restrictive regimes, data like this could be genuinely dangerous if misused. And while WhatsApp says it has \u201cno evidence of malicious actors abusing this vector,\u201d absence of evidence is not evidence of absence, especially for scraping activity, which is notoriously hard to detect after the fact<\/p>\n
If someone has already scraped your data, you can\u2019t undo it. But you can reduce what\u2019s visible going forward:<\/p>\n
\n
- Avoid putting sensitive details in your WhatsApp \u201cabout\u201d section, or in any social network profile.<\/li>\n
- Set your profile photo and \u201cabout\u201d information to be visible only to your contacts.<\/li>\n
- Assume your phone number acts as a long-term identifier. Keep public information linked to it minimal.<\/li>\n<\/ul>\n
Your name, address, and phone number may already\u00a0be for sale.\u00a0<\/strong>\u00a0<\/p>\n
Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way.\u00a0<\/p>\n
SCAN NOW<\/p>\n
\n\n Related:<\/strong>
\n
\n Digital Automation Training Benin: 5 Winning Skills Employers Demand in 2026
\n <\/a>\n <\/p>\n\n
\n WhatsApp Marketing Automation Africa: 6 Dangerous Mistakes Brands Make in Nigeria
\n <\/a>\n <\/p>\n<\/div>\n\nWant to learn this practically?<\/h3>\n
Join Justfine Infotech<\/strong> and build real digital skills in AI, automation, web development, digital marketing, office productivity, e-commerce, freelancing and cybersecurity.<\/p>\n
Available Programmes:<\/strong>
\n 6 Weeks Certificate \u2022 3 Months Professional<\/a> Certificate \u2022 6 Months Diploma \u2022 Full Professional Diploma<\/p>\nWhatsApp:<\/strong>
\n +229 01 57 57 99 15
\n +229 01 66 68 11 60<\/p>\n