Security Breach in WhatsApp: Massive Leak of Phone Numbers

A team of researchers from the University of Vienna has uncovered a significant vulnerability in WhatsApp, which enabled the mass collection of users' phone numbers through the contact search mechanism. By simply iterating through numbers via the web version of the service, they managed to gather over 3.5 billion records, effectively creating a database of phone numbers for most users on the platform. This was reported by Wired.
In addition to phone numbers, the researchers were able to download profile avatars for 57% of accounts and public profile texts for 29%, as this information is displayed to anyone who adds the number to their contacts. The team reported the issue to Meta in April 2025 and deleted the collected database. In October, the company implemented stricter rate limits on requests to close off the possibility of mass verifications.
Meta stated that it found no signs of malicious use of this technique, and the reported data was "basic public information." However, the researchers emphasize that they did not circumvent any protective mechanisms – there simply were none. A similar vulnerability was described by another researcher back in 2017, but it was never fixed.
The analysis also revealed a significant number of accounts with public information. For example, among 137 million numbers from the USA, 44% had open photos. In India, where WhatsApp is most popular, this figure reached 62%.
The researchers believe that databases of this scale could be of interest to spam campaigns or to governments of countries where WhatsApp is blocked. Among the data collected, they found 2.3 million numbers from China and 1.6 million from Myanmar, which could pose risks for users in those countries.
The team also discovered repeated cryptographic keys in some accounts – this may indicate the use of unofficial WhatsApp clients, particularly by those engaged in fraudulent activities.
The researchers conclude that the main issue is the use of the phone number as a universal identifier. It was not intended to be a private or unique key, but in WhatsApp, it serves as the basis for searching and verifying accounts. Meta is already testing a username system as an alternative.