Meta, the parent company of Facebook, has been fined €251 million ($263 million) by the Irish Data Protection Commission (DPC) for a data protection failure that allowed hackers to access millions of Facebook accounts.
The DPC announced the fine on Tuesday, citing a security flaw in Facebook’s video upload function as the vulnerability that enabled hackers to gain full access to user profiles.
The breach occurred over a two-week period in 2018, affecting around 29 million Facebook accounts globally.
Hackers were able to access sensitive personal data, including email addresses, phone numbers, locations, and places of work.
Graham Doyle, the DPC’s head of communications, criticized Meta for not incorporating robust data protection measures during the development of its platform.
“The failure to build in data protection requirements throughout the design and development cycle can expose individuals to very serious risks and harms, including a risk to the fundamental rights and freedoms of individuals,” Doyle said.
He further highlighted that the exposed vulnerabilities posed a “grave risk of misuse” of users’ personal data.
Meta Ireland and its U.S. parent company addressed the breach shortly after its discovery and reported the issue to the DPC in September 2018.
Despite the prompt remediation, the fine reflects the seriousness of the failure to prevent the breach in the first place.
This is the latest in a series of fines imposed on Meta and other tech giants as global regulators intensify their scrutiny of data privacy practices.
In September, the DPC fined Meta €91 million for failing to protect users’ password data and for delays in notifying the regulator about the issue.
The penalty underscores the growing emphasis on accountability and stricter enforcement of data protection laws worldwide.