Facebook 533 million data leak (2021): what it included
2 min read · Updated October 15, 2026
In April 2021 personal details of about 533 million Facebook users in many countries were posted online. Facebook said the data had been scraped from its platform before late 2019 by abusing a contact-import feature, not through a hack of its systems. It mostly contained phone numbers, names and profile details, which raises phishing and SIM-swap risks.
What happened
A dataset appeared on a hacking forum in April 2021. Facebook explained that the information had been collected by scraping, using a feature that was later fixed, so the leak consisted of older, publicly gathered profile data.
What was included
- ✓Phone numbers linked to accounts.
- ✓Names, locations and profile details.
- ✓For some users, email addresses and dates of birth.
Were you caught up in a major breach?
Old breaches keep circulating for years. Check your email against known breach records for free.
Main risks
The big risk is phone-based: text-message scams, calls that use your real details and attempts to hijack your number. Use an authenticator app instead of SMS for important accounts.
What to do
- ✓Check your email address to see whether it appears in known breach records.
- ✓Change any password you used on the affected service, and anywhere you reused it.
- ✓Turn on two-factor authentication, starting with email and financial accounts.
- ✓Be careful with unexpected messages that mention the service.
- ✓Be sceptical of unexpected texts or calls that use your name or details.
Frequently asked questions
Was this a hack of Facebook?+
The company described it as scraping of data rather than a breach of its systems. Either way the information circulated widely.
Were passwords exposed?+
Passwords were not reported to be part of this dataset.
Should I change my phone number?+
Usually not. Protect your accounts with non-SMS two-factor methods and ask your carrier about extra number protection.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.