Snapchat 'Snappening' Data Leak (2014)

The breach exploited an API vulnerability in Snapchat's 'Find Friends' feature, which allowed attackers to submit large batches of phone numbers and match them against Snapchat usernames. Approximately 4.6 million username-phone number pairings were scraped and subsequently posted on a website called SnapchatDB. The attackers partially redacted the data but made it available for download. The incident came just weeks after security researchers had warned Snapchat about the vulnerability. Snapchat later released an update to mitigate the issue. The breach raised significant privacy concerns about the handling of personal data by social media platforms.

Snapchat was a rapidly growing social media platform in 2014, particularly popular among younger users. The platform's 'Find Friends' feature was designed to help users connect with contacts from their phone's address book.

The attack exploited the lack of rate limiting in Snapchat's API. By submitting batches of phone numbers, attackers could query the API to check which numbers were associated with Snapchat accounts and collect the corresponding usernames.

Vulnerabilities exploited

• Lack of API rate limiting

The perpetrator remains unknown. The attack was relatively unsophisticated, exploiting a lack of API rate limiting rather than a complex technical vulnerability.

Attribution sources

• Media Reports
• Security Researchers

Countries affected

• United States
• Global

Data types

• Usernames
• Phone Numbers

Notable documents

• SnapchatDB (leaked database)

Reputational damage and loss of user trust.

Public reaction

Widespread concern about Snapchat's security practices and questions about data retention policies.

Political impact

The incident contributed to broader discussions about API security and user privacy protections on social media platforms.

The FTC investigated Snapchat's security practices, leading to a 20-year consent decree.

Civil lawsuits

• FTC complaint and settlement

Policy changes

• Improved API rate limiting and security practices across the industry.

Security improvements

• Snapchat implemented rate limiting on its API.
• Enhanced user privacy controls.

Significance

The Snappening highlighted the risks of insufficient API security and set a precedent for user phone number protection on social platforms.

Legacy

The incident contributed to the broader movement toward stricter API security standards and rate limiting across the tech industry.

Publishing organisations

• SnapchatDB

Snapchat released an update to address the vulnerability and agreed to 20 years of FTC monitoring.

Official documents

• FTC consent decree with Snapchat

References

1. [1]Media reports (The Verge, TechCrunch, 2014)
2. [2]FTC filing