[coatmatter]

Facebook has released an official statement which appears to confirm my suspicions about how the data was more or less obtained (i.e., via number search): https://about.fb.com/news/2021/04/facts-on-news-reports-abou... (relevant discussion at https://twitter.com/troyhunt/status/1379579465148157953).

But I too noticed the breach rate in the Middle East seemed unusually high, except my initial assumption was that perhaps the way Facebook was introduced there led to different behaviours in how one finds each other on Facebook. Perhaps it could be even something as simple as small differences in translation that lead to different behaviours when it comes to setting up a Facebook account.

The reason this is my initial hunch (rather than any kind of targeted campaign) is because different parts of the world interact differently with different communications platforms. For example, iMessage is very popular in USA whereas other parts of the world favour WhatsApp, or Telegram, or WeChat, etc. Is there any one concrete reason why one population might choose one "less secure" app over another "more secure" chat app/social network? I'd say probably not and yet, we see large variations depending on which border surrounds a user.

So perhaps a similar 'benign' explanation could explain the high breach rate in certain countries. Perhaps phone numbers are treated differently there too? Other than that, I have no idea. Unfortunately, I know very little about the Middle East let alone the languages there, so this is mostly just a guess.

[ehsankia]

The rates in those countries are way too high to be some optional feature like a messenger. It has to be something that was 100% turned on in those countries, but maybe optional/opt-in in the west? Or maybe they were doing gradual rollout of the feature, and they had rolled out in those countries fully and were at like 10-20% rollout in north america?