Name and email addresses of Facebook users are available online at prices as low as $5 per million.
The dodgy trade was uncovered by Bogomil Shopov, an internet marketeer and blogger in the Czech Republic. Shopov said he approached the social network about the problem. He said Facebook asked him to forward and then delete the data, which came in the form on a compressed spreadsheet. Facebook representatives also wanted to know where he'd bought the data and what payment systems were used, he said, adding that he had been happy to answer.
However, the Czech blogger said he objected to requests he says were made by the Facebook representatives to keep his conversations with with them about the matter a secret. He said Facebook told him it was running an internal legal investigation but dragged its feet when it came to promising to advise users about how to avoid their data ending up in the hands of unscrupulous data brokers. "I asked if it was possible to tell what the problem was, after they finished the investigation, so that the users could protect themselves, but they they emphasised that it would be an internal investigation and they would not share any information with third parties," Shopov wrote in an updated blog post.
Shopov suspects the Facebook data, which contained Facebook profile URLs as well as email addresses and names on users of the social network, came from a third-party developer. Shopov said ads advertising the sale of the data were pulled soon after he tipped Facebook off about the issue. The Czech blogger was able to verify that at least some of the email addresses contained in the list were accurate.
Shopov told El Reg that other sites are offering Facebook data for sale. "I know two so far and it seems the part of the data is (was) available in a post in Facebook," he said.
In a statement, Facebook said early indications were that the data was scraped from its site before being bundled with other information and sold online, probably illegally.
Facebook is vigilant about protecting our users from those who would try to expose any form of user information. In this case, it appears someone has attempted to scrape information from our site and combine the information with data publicly available elsewhere on the web.
We have dedicated security engineers and teams that look into, and take aggressive action on reports just like these. In addition to the engineering teams that build tools to block scraping we also have a dedicated enforcement team that seeks to identify those responsible for breaking our terms and works with our legal team to ensure appropriate consequences follow.
We continue to investigate this specific individual.
Shopov told El Reg that he didn't believe the data was scraped from Facebook. Whoever is behind the scam can expect to face sanctions from Facebook, up to and including the possibility of criminal prosecution.
Thriving trade in black market likes
In other Facebook-related security news, Imperva warned that it had uncovered a bustling trade in social network fraud on an online black market it monitors. The 250,000-member hacker forum plays host to a thriving black market for buying and selling illegitimate social network "Likes", followers, and endorsements, with particular attention given to the origin of these Likes and followers.
"Likes and followers can be used to gain rank, win competitions, and many other causes that can often be translated to monetary profit," Imperva explains. "Many forum discussions contain requests to buy Facebook friends and Likes, Twitter followers and other types of social currency. There are, of course, many who are willing to provide the service, for variable prices."
A thousand Facebook Likes can be easily purchased for $10 or less, with discounts for bulk purchases.
Imperva's report on the hacker forum, published on Tuesday, can be found here (PDF). ®