According to reports from Bloomberg, Apple and Meta (Facebook) have been tricked by giving user data to hackers pretending to be law enforcement.

The thing is, both tech companies fell victim to fake emergency data requests back in 2021 and, we’re just learning from it now. The fake emergency data requests (ERDs) asked both companies to hand over other sensitive data, including IP addresses, phone numbers, and home addresses for its users. The outlet also mentions that Snap, Inc. (Snapchat) received a forged legal request from the same hackers. But we’re not sure if they fell for the bait.

Andy Stone, Meta’s policy and communications director told IGN in an email.

“We review every data request for legal sufficiency and use advanced systems and processes to validate law enforcement requests and detect abuse. We block known compromised accounts from making requests and work with law enforcement to respond to incidents involving suspected fraudulent requests, as we have done in this case.”

“This tactic poses a significant threat across the tech industry. We are continuously investing in our Trust & Safety capabilities to address emerging issues like this one”

Apple also fell for the bait, by following its own policy. Particularly a section in its law enforcement guidelines. The statement read.

“If a government or law enforcement agency seeks customer data in response to an Emergency Government & Law Enforcement Information Request, a supervisor for the government or law enforcement agent who submitted the Emergency Government & Law Enforcement Information Request may be contacted and asked to confirm to Apple that the emergency request was legitimate,”

A few days ago it was also reported by Krebs on Security that an 18-year-old hacker did the same thing with Discord by pretending to be law enforcement. The report further noted that EDRs are becoming increasingly common, with hackers sending fake emergency data requests by hacking into a police department’s email and then contacting the victim.

So who’s to blame for these fake ERDs? That is yet to be found out. Bloomberg believes the infamous hacking group, Lapsus$, maybe the culprit or at least involved. Lapsus$ has been responsible for hacking several big tech companies, including Microsoft, Samsung, and Nvidia, to name a few.

So how to keep your accounts safe? By keeping changing your passwords regularly, and not having the same password for multiple accounts. Also, stop using 12345 as a password!