Meta left some user passwords in plaintext — the Irish DPC fined it €91M

On 27 September 2024 Ireland's Data Protection Commission fined Meta Platforms Ireland €91 million ($102M) after a subset of user passwords was stored in plaintext — unencrypted and readable — inside the company's internal systems. Hundreds of millions of Facebook Lite users, tens of millions of other Facebook users and millions of Instagram users were affected.

The fine came even though no passwords ever reached outsiders and no abuse was found. The regulator ruled that Meta had failed GDPR's security duties by not assessing the risks of how passwords were processed, and had also failed to formally report the matter as a personal data breach or document it as required.

Meta itself had brought the issue to the DPC in March 2019, saying the passwords were temporarily logged in a readable format and the error was fixed. The inquiry opened the following month and the decision landed five and a half years later. The DPC said storing passwords in plaintext is widely accepted as unacceptable, because anyone reaching the data reaches the accounts.