Researchers discovered that anyone could scrape the phone numbers of all 3.5 billion WhatsApp users — simply by trying to add every possible number through WhatsApp Web. For most users, profile photos and status text were also visible. No hacking tricks were needed; WhatsApp automatically revealed whether a number had an account.
Meta was warned about this issue back in 2017 but didn’t fix it until October 2025, after Austrian researchers reported it again. Meta says only publicly visible info was exposed and claims there’s no evidence the flaw was exploited by malicious actors. Still, the lack of rate limits meant the data could have been harvested for years.
Source: GSMArena
