A newly discovered algorithmic vulnerability in Meta's account-linking API allowed threat actors to systematically scrape and aggregate user data profile configurations. The automated campaign linked private telephone numbers directly to public account profiles on a global scale.