Facebook Marketplace Data Breach (2023)

On October 1, 2023, 77,000 unique individuals learned their Facebook Marketplace activity had been exposed when the dataset appeared in a popular hacking forum. The records, allegedly taken from a Meta contractor in October 2023, contained names, email addresses, phone numbers, geographic locations, Facebook profile IDs, and bcrypt password hashes. Although the incident is now listed on Have I Been Pwned, the breach notification does not confirm whether the hashes match actual Facebook account credentials.

Reported Details from the Listing

The primary disclosure on Have I Been Pwned states that approximately 200,000 Facebook Marketplace records were posted to a hacking forum in February 2024. These records yielded 77,000 unique email addresses along with full names, phone numbers, Facebook profile IDs, and geographic location data. The dataset also included bcrypt password hashes, but the listing explicitly notes there is no indication these hashes correspond to the victims’ Facebook accounts themselves. The breach is dated to October 2023 and is attributed to data obtained from a Meta contractor rather than a direct compromise of Meta’s own systems. No ransom demand or extortion timeline is mentioned in the public disclosure.

Why This Matters for You and Your Family

When your name, phone number, email address, and physical location are bundled together with your Facebook profile ID, the information becomes a ready-made profile for identity thieves, stalkers, or scammers who target everyday users. Phone numbers and geographic locations are especially dangerous because they allow someone to connect your online activity to your real-world address and daily routines. Families are often affected together: a parent’s Marketplace listing for baby clothes or household items can expose children’s names or school-related details indirectly through location patterns. Even though the password hashes may not unlock Facebook, any password you reused on other sites could now be at risk if the hashes are cracked offline.

The Doxxing and Identity-Chain Risk

Facebook profile IDs are permanent identifiers that link directly to public or semi-public social media accounts. Once an attacker has your profile ID, name, phone, and location, they can map additional accounts across platforms, build a complete identity chain, and launch spear-phishing, SIM-swapping, or physical intimidation. Credential leaks of this nature frequently cascade into gaming account takeovers, especially for households where children use the same email or phone number for Roblox, Fortnite, or Discord. The combination of personal data and social handles creates persistent doxxing chains that can surface months or years later on leak sites, extortion forums, or revenge lists.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate any password you used on Facebook Marketplace or related services and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same contact details.
• Let remediation specialists manage takedown requests for any data-broker listings that surface from this breach.

The incident shows how contractor supply-chain compromises continue to expose ordinary users years after the initial theft. One short forward-looking step is to treat every Marketplace-style interaction as permanently public and to maintain active visibility over where your personal data travels. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control before the next link in the chain appears.