Most major platforms have dealt with large-scale data leaks tied to weak or unprotected APIs. You’ve seen this play out with Facebook, X and even Dell.

The pattern is always the same. A feature meant to make life easier becomes a gateway for bulk data collection.

WhatsApp is now part of that list after researchers managed to scrape 3.5 billion phone numbers by exploiting a simple gap in the app’s contact-discovery system.

Sign up for my FREE CyberGuy Report 
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.   

How the researchers scraped 3.5B WhatsApp numbers

WHATSAPP BANS 6.8M SCAM ACCOUNTS, LAUNCHES SAFETY TOOL

Researchers discovered that weak API limits made it possible to scrape billions of WhatsApp numbers. (Getty Images)

As reported by Bleeping Computer, the entire incident started with WhatsApp’s GetDeviceList API. This is the endpoint the app uses when you add a number to your contacts. It tells WhatsApp to check if that number has an account and what devices are linked to it. The problem was that the API had no meaningful rate limiting. In simple terms, the system didn’t slow down or block repeated requests, which opened the door for mass enumeration.

Researchers from the University of Vienna and SBA Research decided to test how far they could push this. Using only five authenticated sessions and a single university server, they started hammering WhatsApp’s servers with queries. They expected to get blocked fast, but WhatsApp didn’t react at all.

That’s how they were able to check more than 100 million phone numbers per hour. After generating a global pool of 63 billion possible mobile numbers, they ran the list through the API and confirmed 3.5 billion active WhatsApp accounts.

Researchers managed to scrape more than just phone numbers

The researchers didn’t stop at confirming account existence. They used other WhatsApp endpoints like GetUserInfo, GetPrekeys and FetchPicture to pull more details. This included profile photos, “about” text, device information and public keys. A test run in the United States alone downloaded 77 million profile photos without hitting any limits, many with clear images of people’s faces. Public “about” sections often revealed personal info or links to other profiles. When compared to Facebook’s 2021 scrape, they found that 58% of leaked Facebook numbers were still active on WhatsApp years later. That’s what makes phone-number leaks so damaging. They stay useful to attackers long after the initial breach.

RUSSIAN LAWMAKERS CLAIM WHATSAPP IS A NATIONAL SECURITY THREAT, SHOULD PREPARE TO LEAVE THE COUNTRY

It’s important to note that this study was done by researchers who haven’t released the data. They also reported the issue to WhatsApp. The company has since added rate-limiting protections to prevent similar abuse from happening again. Still, the findings show how easily threat actors could have done the same thing if they had found the loophole first.

Why this keeps happening across major platforms

Weak or nonexistent API rate limits have caused several major data leaks in recent years, and WhatsApp isn’t the only example. In 2021, attackers abused Facebook’s “Add Friend” feature by uploading contact lists and checking which numbers matched active accounts. The API lacked proper safeguards, so they scraped 533 million profiles. Meta later confirmed the incident as automated scraping, and the Irish DPC fined the company €265 million.

Twitter had a similar problem when attackers used an API bug to match phone numbers and email addresses to 54 million accounts. Dell also reported that 49 million customer records were scraped after attackers took advantage of an unprotected API endpoint.

All of these cases share the same root cause. APIs that allow account lookups or data queries end up being easy to attack when they don’t limit how often someone can access them. One unchecked feature can turn into a pipeline for mass data collection.

7 steps you can take to keep your WhatsApp data safe

If your phone number ends up in one of these massive scrapes, you can’t pull it back, but you can make sure it’s far less useful to anyone trying to target you. Here are a few steps that help you stay safer.

1) Use two-factor authentication

Turn on 2FA for WhatsApp and every other important account. Even if someone has your number, they can’t break in without that second verification step. It also protects you from SIM-swap attempts since thieves can’t access your accounts with just a password.

A simple automated script pulled phone data at a massive scale without triggering alerts. (eyecrave productions/Getty Images)

2) Use a password manager

A password manager keeps every login unique. If attackers try to pair your scraped number with credential-stuffing attacks, reused passwords won’t give them an easy win. Strong, random passwords shut down a whole category of automated attacks.

Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

3) Remove your data from public databases

Opt out of data brokers and people-search sites when you can. The less public information attackers can tie to your number, the harder it is for them to craft convincing phishing messages or identity-based scams.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

IS YOUR FRIEND’S PHONE NUMBER COMPROMISED? HERE’S WHAT TO LOOK FOR

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

4) Limit what you share in profile bios

Keep your WhatsApp “about” text minimal. Avoid details like job titles, hometowns, or links to other accounts. Scraped phone numbers often get paired with publicly visible bios to build fuller profiles for scams.

5) Tighten your privacy settings

Adjust who can see your profile photo, last-seen and status. Setting these to “Contacts only” or “Nobody” prevents strangers from pulling more personal info once they have your number. To tighten your privacy settings on WhatsApp on iPhone or Android, follow these steps:

• Open WhatsApp on your phone on your phone.
• Go to Settings: On iPhone, tap the “Settings” gear icon at the bottom right. On Android, tap the three vertical dots in the top-right corner, then select “Settings.”
• Tap “Account.”
• Tap “Privacy.”
• Adjust the privacy options below to control who can see your personal info:
• Last Seen & Online: Tap “Last Seen & Online” and choose “My Contacts” or “Nobody” to restrict who sees your last active status.
• Profile Photo: Tap “Profile Photo” and select “My Contacts” or “Nobody” to prevent strangers from viewing your profile picture.
• About: Tap “About” and pick “My Contacts” or “Nobody” to limit who can see your About info.
• Status: Tap “Status,” then select “My Contacts,” “My Contacts Except…,” or “Only Share With…” to control who can view your status updates.

These changes prevent people not in your contacts or strangers from pulling personal details from your WhatsApp profile, enhancing your privacy effectively on either iPhone or Android devices.

Because the system lacked proper rate-limiting, the scraping continued undetected for months. (Kurt Knutsson)

6) Install strong antivirus software

A lot of phishing and malware campaigns start with scraped numbers. Strong antivirus software can block malicious links, detect harmful downloads and warn you when something looks suspicious.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

7) Be cautious with unknown calls and messages

Treat unexpected messages with more suspicion. Don’t click links, don’t share OTPs, and don’t respond to anyone asking for verification codes. Once numbers are scraped, scammers ramp up spam and impersonation attempts.

Kurt’s key takeaway

WhatsApp might have fixed the issue, but the bigger problem is still out there. Any platform that exposes an API without proper rate limits is leaving a window open for someone with the right tools and enough time. This scrape shows you how quickly that window can turn into a firehose of personal data. Until API security becomes a priority across the board, you’ll keep seeing leaks like this repeat on bigger and bigger scales.

Do you think apps should be legally required to enforce strict API limits? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report 
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

Copyright 2025 CyberGuy.com.  All rights reserved.

Holiday travel is stressful enough with crowded airports, expensive flights and last-minute itinerary changes. But there’s a hidden part of the travel industry most people don’t know about: your personal data is being harvested, packaged and sold every time you book a flight, reserve a hotel room or check a travel app.

Whether you’re traveling for a Christmas break or booking early for New Year’s, the companies you trust with your most sensitive details—full name, home address, passport info, travel dates and device data—are sharing and selling far more than you think.

And during the holiday rush, that data becomes a goldmine for scammers.

Let’s unpack how this works, which companies collect the most and what you can do before you travel to keep your personal information out of the wrong hands.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

PROTECT YOUR DATA BEFORE HOLIDAY SHOPPING SCAMS STRIKE

Holiday travel brings more than stress because every booking and check-in quietly generates personal data you may not realize you are giving away. (iStock)

Why holiday travel puts your data at risk

The holiday season is the peak period for travel-related data collection. Airlines, hotels, booking platforms, loyalty programs and travel apps all experience massive traffic spikes—millions of Americans are searching for deals, comparing prices, checking gate changes and re-booking delayed flights.

Every one of those actions creates trackable data points, including:

• Email address
• Phone number
• Full name and DOB
• Address history
• Travel itineraries
• Passport or ID data
• Device fingerprint
• IP address and location
• Shopping habits and spending patterns.

You might assume this data stays with the airline or hotel. It doesn’t.

Most companies share it with advertisers, analytics firms, data brokers and dozens of unnamed “partners.” Some even use your data to profile you—how often you travel, how much you’ll likely spend and whether you’re a “high-value” target.

That information can easily leak into scammer databases, which is why holiday travelers suddenly see:

• Fake “your flight is canceled” texts
• Phishing emails that look identical to hotel confirmations
• Bogus baggage fee requests
• Fake TSA PreCheck renewal notices
• “Urgent re-verification required” messages.

Scammers rely on the fact that you’re stressed, rushing and expecting travel updates. And because they already have your personal data, their attacks are frighteningly convincing.

STOP FOREIGN-OWNED APPS FROM HARVESTING YOUR PERSONAL DATA

Airlines, hotels, apps and booking platforms collect far more information than most travelers know and that data often gets shared with advertisers and data brokers. (AP Photo/Ryan Sun)

Examples of what major travel companies collect

Here are real-world examples of how holiday travel platforms collect and share your data:

1) Airlines (Delta, American, United, Southwest)

Major U.S. airlines collect not just your name, phone number and email, but also travel companions, payment details, geolocation data, device data and loyalty-program activity.

They share this with:

• “Marketing partners”
• Analytics platforms
• Third-party advertisers
• Data-enrichment firms.

Many of these partners, over time, become part of the data broker ecosystem.

2) Booking platforms (Expedia, Booking.com, Hotels.com)

Each booking platform details what it collects in its privacy policy. Oftentimes, these sites track:

• Search history
• Price views
• Device fingerprint
• Click behavior
• IP-based location
• Payment attempts—even abandoned carts.

This is used to build profiles that determine what deals you’re shown and how aggressively you’re targeted.

3) Hotel chains (Marriott, Hilton, IHG)

Marriott’s privacy policy and other privacy statements list over 60 categories of data it collects. Some chains were caught sharing guest data with:

• Ad networks
• Social media platforms
• Third-party “guest experience” tools
• Affiliate networks
• Data brokers for cross-device tracking.

Cybercriminals have been using the information of over 500 million Marriott guests, exposed during a four-year-long breach that started in 2014, to craft and execute travel-themed scams to this day.

4) Travel apps (Airbnb, Hopper, KAYAK, TripIt)

These are some of the most aggressive data collectors because they run nonstop on your phone. Many collect:

• Real-time location
• Contacts
• Clipboard data
• Behavioral analytics
• Device ID
• In-app browsing.

Some of these firms then “share information with partners for marketing enhancement,” which is typically code for data selling.

YOUR DISCARDED LUGGAGE TAGS ARE WORTH MONEY TO SCAMMERS

Scammers use leaked travel details to send fake flight alerts, hotel messages and urgent payment notices that look real because they already have your personal information. (iStock)

How scammers use your travel data

Once your information enters the ecosystem, scammers build travel-themed attacks designed to hit you at the worst possible time. Some common examples include:

• Fake airline notifications: (e.g., “Your flight has been canceled, click here to rebook”)
• Urgent hotel “payment failure” emails: Scammers use leaked address and booking data to send emails that look exactly like they’re from the Hilton or Marriott
• Fake baggage fees: (e.g., “Pay $24.90 to release your checked bag”)
• TSA and Global Entry renewal scams.

This isn’t guesswork. They already have your name, flight, hotel, location and travel dates—because the travel industry’s data partners sold or leaked them.

How to protect yourself before you travel

Here are my top steps to staying private this holiday season:

1) Check what data the travel companies already have

Hotels, airlines and booking sites all have data removal options—though they’re buried in their privacy settings.

2) Stop apps from tracking your location

Turn off location permissions for apps like:

• Hopper
• Airbnb
• Expedia
• HotelTonight.

Many track you even when not in use. Here’s how to do it for iPhone and Android:

On iPhone: Open Settings, tap Privacy & Security, then tap Location Services, scroll down to the app and tap each app, and set location access to “While Using the App” or “Never,” and turn off “Share My Location” if you don’t want them to see your exact spot.

On Android: Open Settings, tap Location, then choose App location permissions or App permissions, find the app and tap it, and change each one to “Allow only while using the app” or “Don’t allow” so they can’t track you in the background. (Settings may vary depending on your Android phone’s manufacturer.)

3) Remove your personal data from data broker sites

This is the most important step. Even if you stop airlines and hotels from collecting new data, your existing data is already circulating through dozens of data brokers, and that’s what scammers use to target travelers.

Data brokers hold:

• Your travel patterns
• Address history
• Email and phone details
• Income level
• Household info
• Your family members’ names.

You can manually request removal from hundreds of sites, but it takes months. That’s why I recommend a data removal service. While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

4) Use an email alias for bookings

An alias email reduces the amount of spam and phishing attempts you’ll receive. By creating email aliases, you can also protect your information. These aliases forward messages to your primary address, making it easier to manage incoming communications and avoid data breaches. 

For recommendations on private and secure email providers that offer alias addresses, visit Cyberguy.com

5) Avoid airport Wi-Fi for anything involving payments

Scammers often run fake hotspots. So, avoid airport public Wi-Fi when accessing financial information.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt’s key takeaways

The holiday season is here, and many of us are getting ready to travel to see family and friends. As travel picks up, personal data collection and sharing also increases. Airlines, hotels and travel apps often share your information with unknown third parties, which scammers can use to target you during your trip. Before you pack your bags, take a few minutes to remove your personal data from online brokers. Doing this helps protect your identity and lets you travel with peace of mind.

How do you protect your personal information when you travel during the holidays? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com.  All rights reserved.

When Xpeng unveiled its Next Gen Iron humanoid recently, the robot glided across the stage with movement so fluid that the crowd froze. Many viewers thought they saw an actor in a suit. Clips spread online within hours, and people everywhere claimed the same thing: it looked too human to be a machine.

The reaction spread fast, so Xpeng’s CEO He Xiaopeng returned to the stage one day later with a plan to settle the argument. He cut into Iron’s leg to show its internal machinery. It felt theatrical but also necessary to end the rumor that a human controlled the robot from inside.

The demonstration showed Iron was a real machine with complex systems beneath its flexible skin.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

ELON MUSK TEASES A FUTURE RUN BY ROBOTS

Iron’s debut stunned the crowd as the humanoid bot walked with movement so natural that many viewers thought there was a real person inside. (Xpeng)

Inside the next-gen iron humanoid

He shared how his robotics team stayed awake through the night, seeing viewers accuse them of staging a stunt. After the reveal, Iron walked again in front of the crowd without a human inside. The moment closed the debate and highlighted how far the company has come since its first model in 2024.

The latest Iron uses a humanoid spine with bionic muscles and flexible skin. It moves with 82 degrees of freedom, and its human-sized hands include 22 degrees of freedom supported by a tiny harmonic joint engineered by the company. The robot runs on all solid-state batteries that keep the body light and strong.

Iron also uses Xpeng’s second-generation VLA model. Three Turing chips with 2,250 TOPS of power support tasks like conversations, walking and natural interactions. It responds in ways that feel closer to a person than a robot.

Xpeng says future versions will offer different body shapes. That claim hints at customizable designs when these units reach consumers.

SMART FABRIC MUSCLES COULD CHANGE HOW WE MOVE

To silence the rumors, the team cut open Iron’s leg onstage and revealed the machinery beneath its flexible skin. (Xpeng)

A step toward a future of humanoid robots

Xpeng’s long-term vision goes far beyond a single showcase moment. The company plans to place the Next Gen Iron model in real-world environments. Early units will focus on commercial roles such as tour guides, shopping guides and customer service helpers. These placements allow the robots to interact with large crowds, gather feedback and refine their behavior in dynamic public spaces.

This rollout forms part of what Xpeng describes as a gradual path toward mass production. The team aims to reach large-scale manufacturing by the end of 2026. That milestone could introduce hundreds or even thousands of humanoid units into select venues. Businesses may adopt them to manage foot traffic, assist guests or support basic retail tasks.

While the company talks openly about commercial integration, the timeline for home use remains unclear. They have not shared when consumers will be able to buy a version suited for daily household tasks. Engineers still need to address safety, privacy and reliability standards before a humanoid can operate inside private homes.

Even so, this moment signals a clear shift: robots that move and react in a lifelike way are no longer far-off ideas. They are stepping into public spaces where people will see them operate up close. This shift could reshape how we all view service work and personal assistance in the years ahead.

THE NEW ROBOT THAT COULD MAKE CHORES A THING OF THE PAST

The exposed frame shows Iron’s bionic muscles, joints and wiring, giving a clear look at the advanced engineering that powers its lifelike movement. (Xpeng)

What this means for you

Humanoid robots are moving from concept to reality. You may soon see them in museums or stores. Their skills could speed up service and reduce wait times. These robots may also raise new questions about safety, privacy and comfort. Change happens fast, and this moment marks a major shift in how robots blend into daily life.

Take my quiz: How safe is your online security?

Think your devices and data are truly protected? Take this quick quiz to see where your digital habits stand. From passwords to Wi-Fi settings, you’ll get a personalized breakdown of what you’re doing right and what needs improvement. Take my Quiz here: Cyberguy.com 

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt’s key takeaways

Xpeng wanted attention for its new humanoid, but received much more after people doubted what they saw. The dramatic reveal aimed to rebuild trust and show a future where robots can move and react with true precision. The next two years will shape how these machines enter real-world use.

Would you feel excited or uneasy walking up to a lifelike robot in a public place? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com.  All rights reserved.