A database of 487 million cell phone numbers from active WhatsApp users is currently available for sale through relevant channels. Based on a sample of almost 2,000 numbers, Cybernews assumes that the data is indeed up-to-date. Where they come from is uncertain.
The source does not have to be WhatsApp
The data set contains almost 500 million cell phone numbers from 84 countries. All cell phone numbers are said to have been registered with WhatsApp until recently. It is currently pure speculation that the source of the data is systems at WhatsApp.
The new “WhatsApp database” may also be based on older data from other illegal sources. Providers may have added the “is on WhatsApp” information through other means. The sellers did not want to give Cybernews any details, saying they “used their strategies”.
In the summer of 2021, hackers had created data on over 700 million LinkedIn users by automatically tapping the information visible on the profile pages. As early as spring 2021, a data set with over 500 million Facebook user accounts was circulating on the web, which, in addition to data from so-called screen scraping, also contained data read out in bulk via APIs provided by Facebook – these API accesses were ultimately due to a security gap in Facebook's interface . This vulnerability in the “Add Friends” function allowed the phone numbers to be tapped regardless of the user privacy settings made by the user.
0.033 cents per number
The cell phone numbers are currently offered in country-specific packages. As reported by Cybernews, all numbers from the US will cost US$7,000, US$2,500 from the UK and US$2,000 from Germany. Six million cell phone numbers with a German area code should be included in the data set. A number would therefore be worth around 0.033 cents to buyers.
Buyers of the data records could use the numbers to deal with phishing messages or even calls (as was recently the case with the Europol announcements ) to reach active users without wastage. Since there is obviously no further information in the data set apart from the cell phone number, there is no direct danger from knowing the cell phone number.