{“lastseen”:”2026-04-09T10:29:54″,”description”:”Every tech company tells you your data is safe. They’ve (hopefully) got encryption, access controls, and zero-trust architectures\u2014the whole glossy security brochure. And then someone on the inside writes a script to steal your private photos anyway.\\n\\nThat’s what a former Meta employee based in London is under criminal investigation for. He allegedly downloaded around 30,000 private images belonging to Facebook users. The Metropolitan Police’s cybercrime unit is handling the case.\\n\\nAccording to court papers, the accused didn’t just browse around; he built a custom script designed to circumvent Meta’s internal detection systems.\\n\\n## **Meta ‘s response**\\n\\nMeta says it discovered the breach over a year ago, fired the individual, notified affected users, and referred the matter to UK law enforcement. The suspect is currently on police bail and must report to officers in May.\\n\\nMeta’s track record on data protection is far from spotless. It agreed to pay $725 million in 2022 to settle a class-action lawsuit over the Cambridge Analytica scandal, where third-party developers harvested data from millions of Facebook users. Stories keep surfacing about Meta that give us pause when considering privacy and user safety. For example, Facebook engineers have admitted that they didn’t even know where user data was kept.\\n\\n## **Rogue insiders**\\n\\nThis kind of thing keeps happening. FinWise Bank disclosed last year that a former employee had potentially accessed records belonging to 689,000 customers. That breach went undetected for over a year. Coinbase also revealed that support staff working overseas had been bribed to steal data on nearly 70,000 customers. Even employees at electronics repair firms like to snoop around customers’ data in ways they shouldn’t.\\n\\nWhat drives insiders to cross the line? Research into insider threat psychology has found that many documented incidents involve employees in technical professions like system administrators, database operators, and programmers. This makes sense, as they will likely have both the access and the skills to evade detection.\\n\\nMotives range from financial gain to personal spite (as with this grocery store employee who leaked staff data) or voyeurism (as with this Yahoo engineer who accessed women’s nudes including those of women he knew personally). Employees will often commit their crimes after they’ve left the company, if administrators are lax about revoking system access.\\n\\n## **How to protect yourself**\\n\\nCompanies will tell you they take privacy seriously, and many do.\\n\\nThe standard defenses by companies against insider threats are well known: least-privilege access controls, multi-factor authentication, continuous monitoring of user behavior, and regular security audits. But the Meta case suggests that someone determined enough and technical enough to write their own tools can still sometimes circumvent those defenses. \\n\\nSo what can users do? \\n\\nStore your most sensitive data (like private images) in a secure, password-protected environment. If a service doesn\u2019t offer strong controls, it\u2019s worth asking whether you\u2019re comfortable trusting everyone who might have access behind the scenes.\\n\\nCheck out how to reduce your digital footprint and limit the info scammers and extortionists can use against you. \\n\\n* * *\\n\\n**We don ‘t just report on threats – we help protect your social media**\\n\\nCybersecurity risks should never spread beyond a headline. Protect your social media accounts by using Malwarebytes Identity Theft Protection.”,”published”:”2026-04-09T10:07:37″,”modified”:”2026-04-09T10:07:37″,”type”:”malwarebytes”,”title”:”30,000 private Facebook images allegedly downloaded by Meta employee”,”source”:””,”references”:””,”id”:”MALWAREBYTES:86B203FD86912D4377052F7CBFFD3E9E”,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.malwarebytes.com\/blog\/data-breaches\/2026\/04\/30000-private-facebook-images-allegedly-downloaded-by-meta-employee”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-09T10:29:54″,”description”:”Every tech company tells you your data is safe. They’ve (hopefully) got encryption, access controls, and zero-trust architectures\u2014the whole glossy security brochure. And then someone…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,115,13,33,7,11,5],"class_list":["post-42801","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-malwarebytes","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n