What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Meta Platforms Ireland was fined €91 million on September 27, 2024, over certain Facebook-related passwords that were stored in readable form on internal systems in 2019. The figure sometimes reported as $101.5 million was an approximate dollar conversion, not a separate U.S. penalty.
The Irish Data Protection Commission (DPC) found failures involving password security, breach notification and breach documentation. However, the cited primary sources do not establish that outside attackers obtained or abused the passwords. Meta said it found no evidence of improper internal access or misuse.
As an Amazon Associate I earn from qualifying purchases.
What Meta was fined for
The case was not simply a confirmed hacker theft of Facebook passwords. The DPC found that Meta Platforms Ireland Limited failed to meet several obligations under the EU General Data Protection Regulation (GDPR):
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- GDPR Article 33(1): Meta did not notify the DPC without undue delay and within 72 hours after discovering one plaintext-password incident.
- GDPR Article 33(5): Meta failed to properly document two personal-data breaches.
- GDPR Article 5(1)(f): Meta failed to ensure appropriate security for personal data.
- GDPR Article 32(1): Meta failed to implement appropriate technical and organizational measures proportionate to the risk.
The DPC’s final decision says the incidents involved passwords being stored in plaintext—meaning readable rather than protected through the normal password-storage process.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What “stored in plaintext” means
When a service handles a password properly, it generally does not need to retain the original readable password. Instead, it stores a one-way cryptographic representation, commonly described as a salted hash. During login, the submitted password is processed and compared with the stored representation.
A plaintext password, by contrast, can be read in its original form by someone with sufficiently broad access to the relevant system or logs. That creates a serious risk because passwords are credentials, not merely ordinary pieces of profile information. They can enable account takeover and, when reused, access to email, banking, shopping, workplace or other accounts.
Plaintext storage does not automatically prove that an outsider downloaded or used the passwords. Meta’s 2019 disclosure said the affected passwords were not visible outside Facebook and that the company had found no evidence of improper internal access or abuse. The DPC nevertheless treated the incidents as personal-data breaches because the storage practice created a risk of unauthorized processing.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsHashing is also not an absolute guarantee. Weak password-handling systems can remain vulnerable if hashes are exposed, poorly protected or susceptible to offline cracking. The central failure in this case was that some passwords were recorded in readable form at all.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What happened and when
The incident was discovered and investigated over several years:
- January 7, 2019: Meta identified one plaintext-password logging incident.
- January 31, 2019: Meta identified another incident.
- March 21, 2019: Meta notified the DPC that certain passwords had been inadvertently stored in plaintext.
- March 2019: Meta publicly disclosed the issue.
- April 24, 2019: The DPC opened an own-initiative statutory inquiry.
- June 2024: The DPC submitted a draft decision to other concerned EU/EEA supervisory authorities.
- September 26, 2024: The DPC adopted its final decision.
- September 27, 2024: The DPC announced the reprimand and €91 million fine.
The roughly four-and-a-half-year gap between the 2019 discovery and the 2024 enforcement announcement reflects the length of the regulatory process; it does not mean the password storage occurred in 2024.
How many users were affected?
The numbers should not be flattened into one claim that “hundreds of millions of passwords were stolen.” Meta’s estimates changed as it investigated:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- In March 2019, Meta said it expected to notify hundreds of millions of Facebook Lite users, tens of millions of other Facebook users and tens of thousands of Instagram users.
- In an April 2019 update, Meta said it had found additional Instagram password logs and estimated that the issue affected millions of Instagram users.
- The DPC’s final decision characterizes the affected personal data as involving tens of millions of Facebook users.
These are different descriptions from different points in the investigation. They do not establish one confirmed total, and they do not establish that every user included in Meta’s broader notification estimates had a readable password accessed by another person.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Were the passwords hacked or abused?
That has not been established by the cited primary sources. Meta reported that the passwords were not visible outside Facebook and that it found no evidence of improper internal access or abuse. The DPC’s action was based on the insecure storage and related compliance failures, not on a finding that an external criminal had successfully used the credentials.
From a consumer-protection perspective, the distinction matters but does not make the practice harmless. Readable credentials could have created risks of fraud, impersonation, spam and financial or reputational loss. A reused Facebook password could also have increased exposure on an entirely different service.
Why Ireland’s regulator handled the case
The investigated company was Meta Platforms Ireland Limited. For the cross-border processing covered by the inquiry, Ireland’s DPC acted as the lead supervisory authority under the GDPR’s cooperation framework.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →The DPC submitted its draft decision to other concerned EU/EEA supervisory authorities in June 2024 and said no objections were raised through that process. It is therefore more precise to call this an enforcement decision by Ireland’s DPC under the GDPR—not simply “the EU fining Facebook.”
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why the fine was €91 million
The penalty had three components, alongside a formal reprimand:
| Finding | Fine |
|---|---|
| Failure to notify one breach within the required period | €8 million |
| Failure to document two breaches properly | €8 million |
| Inadequate technical and organizational security measures | €75 million |
| Total | €91 million |
The DPC said the total was effective, proportionate and dissuasive after considering the GDPR’s penalty factors. The $101.5 million headline used by some coverage was an approximate conversion of €91 million at the time. Exchange rates change, so the legally precise amount is €91 million.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What Facebook and Instagram users should do now
This is a historical incident. It is not proof that every reader’s account was involved or that a specific password was stolen. The sensible response is account-security maintenance, especially if a password has not changed since 2019 or was reused elsewhere.
- Change an old or reused Facebook password. Use a long, unique password rather than one shared with another service.
- Change every reused password elsewhere. Prioritize email, banking, payment, shopping, work and cloud-storage accounts. A password manager can help create and store unique credentials.
- Enable multifactor authentication. An authenticator app or security key is generally stronger against phishing than SMS, although SMS-based MFA is usually better than no MFA.
- Review active sessions. In Facebook’s current account-security settings, review logged-in devices and remove unfamiliar sessions. Menu names can vary by app version and region.
- Check recovery information. Confirm that the recovery email address and phone number are yours and that no unfamiliar account changes were made.
- Watch for phishing. Treat unexpected password-reset messages, “breach notifications” and urgent requests for payment or login details cautiously. Do not use a link in a suspicious message to secure an account; open the official app or website directly.
- Avoid untrusted breach-checker sites. Never submit a Facebook password to a site claiming to check whether it was exposed. A password manager may also identify reuse without requiring you to hand the password to a third party.
Someone who changed their Facebook password after 2019 may not need to change it again solely because of this case. The more important questions are whether the password is reused, whether it protects a valuable account and whether MFA is enabled.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Why this matters for personal finances
A Facebook credential is not automatically a bank credential. The financial danger arises when people reuse passwords or use a compromised email account for password recovery. An attacker who gains access to email may be able to reset other accounts, intercept alerts or impersonate the account holder.
Password uniqueness limits the damage from one service’s failure. MFA adds another barrier, and phishing-resistant security keys can provide particularly strong protection for high-value accounts when the service supports them. A security key requires planning: users should enroll a backup key or another recovery method and confirm compatibility before relying on it.
No VPN, antivirus product or paid monitoring service would have prevented Meta’s internal plaintext-storage error. Monitoring can sometimes alert users to later credential exposure, but it cannot prove whether a particular Facebook password was involved in this incident.
This was separate from Meta’s €17 million penalty
Do not confuse this case with the DPC’s separate €17 million fine in March 2022 concerning a different 2018 Facebook breach that reportedly affected up to 30 million users. The 2024 €91 million penalty concerned the 2019 plaintext-password incidents and associated GDPR failures.
The broader lesson
The case shows why privacy regulators examine security processes even when there is no confirmed external theft. Passwords are especially sensitive personal data, and a company’s obligations include more than trying to prevent an intrusion. It must use appropriate safeguards, identify incidents, notify regulators when required and maintain records that explain what happened.
For users, the practical lesson is narrower: do not treat the headline as proof that hundreds of millions of people had their passwords stolen. Treat it as a reminder to eliminate password reuse, secure recovery accounts, enable MFA and remain skeptical of messages that exploit old breach news.
Sources: Irish Data Protection Commission announcement; DPC final decision; Meta’s 2019 disclosure; TechCrunch context.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
