All case studies

Where keeping it cost them

Facebook

Logged hundreds of millions of passwords in plaintext

Internal logging captured authentication payloads for debugging and kept the passwords readable, which is verbose observability turning into an incident.

Removed: nothing. Logging stayed verbose enough to capture authentication payloads “for debugging”.

Outcome: hundreds of millions of passwords were stored in plaintext in internal logging systems.

In 2019, researchers found that Facebook stored hundreds of millions of passwords in plaintext in internal logging systems. This happened because logging was overly verbose and captured authentication payloads “for debugging.”

This is over-engineered observability becoming a security incident.

Source: Meta, keeping passwords secure (21 March 2019)