Meta Faces €91 Million Fine from Irish Regulators Over Password Security Lapses

The Irish Data Protection Commission (DPC) has levied a substantial fine of €91 million ($101.5 million) against Meta Platforms, the parent company of Facebook, for failing to adequately protect user passwords. The penalty comes after an investigation revealed that the company stored some user passwords in plaintext, a practice that falls short of industry security standards.

The inquiry began five years ago when Meta alerted the DPC to the issue of improperly stored passwords. Although the company publicly acknowledged the incident at the time, the DPC emphasized that no external parties accessed the compromised passwords.

Graham Doyle, Deputy Commissioner of the Irish DPC, underscored the critical importance of password security. “Storing user passwords in plaintext is universally recognized as insecure due to the potential for misuse if unauthorized individuals gain access to this data,” he stated.

In response to the fine, a Meta spokesperson expressed that the company took immediate action to address the security lapse upon its discovery during a 2019 internal review. The spokesperson affirmed that there is no evidence to suggest any misuse or improper access of the affected passwords and noted that Meta cooperated fully with the DPC throughout the investigation.

The Irish DPC serves as the leading European Union regulator for numerous major U.S. tech companies operating within Ireland. Under the General Data Protection Regulation (GDPR), the DPC has imposed significant fines on Meta, totaling €2.5 billion to date. This includes a record-breaking €1.2 billion fine issued in 2023, which Meta is currently appealing.

This recent penalty highlights the ongoing challenges that technology companies face in securing user data amid increasing global concerns over privacy. The incident serves as a reminder of the stringent regulatory environment and the critical need for robust data protection measures in the digital age.