Ex-WhatsApp cybersecurity head says Meta endangered billions of users in new suit

Meta is facing a new lawsuit from its former WhatsApp cybersecurity head, Attaullah Baig, who alleges the company systematically disregarded critical security flaws, exposing billions of users' data and violating a 2020 government consent order. Baig claims Meta prioritized user growth over addressing issues like unrestricted engineer access to user data and 100,000 daily account hacks, retaliating against him for reporting these failures. This litigation intensifies scrutiny on Meta's data protection practices, particularly given its existing regulatory obligations stemming from past data scandals.

Analysis

Meta Platforms (META) faces a significant legal and regulatory challenge from a lawsuit filed by its former head of cybersecurity for WhatsApp, Attaullah Baig. The complaint alleges systemic deficiencies in data security, including claims that 1,500 engineers had unrestricted access to user data and that the company ignored the daily hacking of over 100,000 accounts, prioritizing user growth over security. These allegations are particularly severe as they suggest a potential violation of a 2020 US government consent order, which imposed a $5bn penalty on Meta and remains in effect until 2040. The plaintiff's credibility is bolstered by his prior roles at PayPal and Capital One and his concurrent complaints to federal regulators like the SEC, signaling potential for broader government scrutiny. While a Meta spokesperson dismissed the claims as distortions from a former employee terminated for poor performance, the detailed nature of the 115-page complaint presents a material governance and reputational risk. This event renews focus on Meta's data protection practices, which have been under intense scrutiny since the Cambridge Analytica scandal, and raises critical questions about the effectiveness of its internal controls and management's commitment to compliance.

Key Decisions for Investors

• Investors should closely monitor for any statements or investigations initiated by the SEC or other federal regulators, as a confirmed violation of the 2020 consent order could lead to substantial new financial penalties.
• The allegations raise serious concerns about Meta's internal controls and governance; it is prudent to reassess the company's risk management framework and the potential for recurring data privacy issues to impact long-term valuation.
• Given the direct conflict between the plaintiff's detailed claims and the company's dismissal, investors should watch for any further evidence or company disclosures that either substantiate or refute the specific security vulnerabilities alleged in the lawsuit.