Researchers compiled a list of 3.5 billion WhatsApp mobile phone numbers and associated personal information by abusing a contact-discovery API that lacked rate limiting.
The team reported the issue to WhatsApp, and the company has since added rate-limiting protections to prevent similar abuse.
While this study was conducted by researchers who have not released the data, it illustrates a common tactic used by threat actors to scrape user information from publicly exposed and unprotected APIs.
GetUserInfo,GetPrekeys, and FetchPicture.
Using these additional APIs, the researchers were able to collect profile photos, “about” text, and information about other devices associated with a WhatsApp phone number.
A test of US numbers downloaded 77 million profile photos without any rate limiting, with many showing identifiable faces. If public “about” text was available, it also revealed personal details and links to other social accounts.
Finally, when the researchers compared their findings with the 2021 Facebook phone-number scrape, they found that 58% of the leaked Facebook numbers were still active on WhatsApp in 2025. The researchers explain that large-scale phone number leaks are so damaging because they can remain useful in other malicious behavior for years.
“With 3.5 B records (i.e., active accounts), we analyze a dataset that would, to our knowledge, classify as the largest data leak in history, had it not been collated as part of a responsibly-conducted research study,” explains the “Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy” paper.
“The dataset contains phone numbers, timestamps, about text, profile pictures, and public keys for E2EE encryption, and its release would entail adverse implications to the included users.”
Other malicious cases of API abuse
WhatsApp’s lack of rate limiting for its APIs is illustrative of a widespread issue on online platforms, where APIs are designed to make it easy to share information and perform tasks, but they also become vectors for large-scale scraping.
In 2021, threat actors exploited a bug in Facebook’s “Add Friend”feature that allowed them to upload contact lists from a phone and check whether those contacts were on the platform. However, this API also did not properly rate-limit requests, allowing threat actors to create profiles for 533 million users that included their phone numbers, Facebook IDs, names, and genders.
Meta later confirmed that the data came from automated scraping of an API that lacked proper safeguards, with the Irish Data Protection Commission (DPC) fining Meta €265 million over the leak.
Twitter faced a similar problem when attackers exploited an API vulnerability to match phone numbers and email addresses to 54 million accounts.
Dell disclosed that 49 million customer records were scraped after attackers abused an unprotected API endpoint.
All of these incidents, including WhatsApp’s, are caused by APIs that perform account or data lookups without adequate rate limits, making them easy targets for large-scale enumeration.
Secrets Security Cheat Sheet: From Sprawl to Control
Whether you’re cleaning up old keys or setting guardrails for AI-generated code, this guide helps your team build securely from the start.
Get the cheat sheet and take the guesswork out of secrets management.