What Happened
The 2025 WhatsApp incident was not a classic password or message-content breach, but a large-scale scraping exposure: researchers at the University of Vienna and SBA Research showed they could enumerate about 3.5 billion registered WhatsApp accounts by abusing the contact-discovery API and collecting public profile data such as phone numbers, profile photos, “about” text, and related metadata, with Meta later tightening rate limits after disclosure in April 2025. The reporting does not give a single definitive “records exposed” figure beyond the 3.5 billion-account enumeration, and WhatsApp said there was no evidence that message content was accessed and that it was already working on anti-scraping protections.
