WhatsApp Vulnerability Exposed Data of 3.5 Billion Users, Researchers Say No Malicious Abuse Detected

New Delhi: A newly published study by researchers at the University of Vienna has revealed that a major security flaw in WhatsApp left personal data of nearly 3.5 billion users exposed through the platform’s contact discovery feature.

According to the research team, the vulnerability allowed them to rapidly test and verify phone numbers at scale, making it possible to identify active WhatsApp accounts around the world. Using an automated system, they generated over 100 million queries per hour and eventually collected information linked to users across 245 countries.

The exposed data included details already visible to anyone who has a user’s phone number—such as public keys, profile photos, “about” texts, and activity timestamps. However, the researchers found that even this limited information could be used to infer additional insights, including users’ operating systems, account age, and the number of linked devices.

What adds to the concern is that a similar warning had been raised as far back as 2017, when a security researcher flagged the absence of rate limits on phone-number lookups—an issue that made mass scraping possible. Despite this, the vulnerability remained unaddressed until the Vienna team demonstrated its scale and ease of exploitation.

Within the first 30 minutes of testing, the researchers were able to extract 30 million U.S. phone numbers, and their data collection continued without any pushback from WhatsApp’s servers.

Meta, WhatsApp’s parent company, acknowledged the findings in a statement to 9to5Mac. The company said it appreciated the researchers’ contribution and credited them for identifying a novel enumeration method that bypassed existing protections. Meta added that it had already been developing advanced anti-scraping measures, and the study helped validate their effectiveness.

The company also confirmed that the researchers securely deleted the collected data and that there is no evidence to suggest the vulnerability had been maliciously exploited.

With inputs from IANS