Fired WhatsApp security head accuses Meta of ignoring major privacy threats

Attaullah Baig said Meta ignored repeated warnings about hacks and data risks on WhatsApp, gave staff wide access to private details and then fired him after he raised concerns

The former head of security at WhatsApp has taken Meta to court, accusing the tech giant of ignoring serious privacy and security problems that could affect billions of users worldwide. The lawsuit, filed in the US District Court for the Northern District of California on Monday, adds to a growing list of whistle-blower claims against the company, The New York Times reported.

What the lawsuit alleges

 

Attaullah Baig, who joined WhatsApp in 2021, claims that thousands of Meta and WhatsApp employees had open access to private user data such as profile photos, contacts, group memberships, and even location details. He further alleged that more than 100,000 WhatsApp accounts were being hacked every day, but his suggestions to fix these vulnerabilities were dismissed.

 

 

According to the lawsuit, Baig repeatedly raised the issue with senior leaders, including Meta’s CEO Mark Zuckerberg. Instead of addressing the concerns, Baig said his managers retaliated, eventually firing him in February 2023, the news report said.

 

Baig is being represented by whistle-blower group Psst.org and law firm Schonbrun, Seplow, Harris, Hoffman & Zeldes. His legal filing argues that Meta’s actions violated a 2019 privacy settlement with the Federal Trade Commission (FTC). That settlement required Meta to improve security, disclose risks to investors, and ensure regular audits of its systems.

 

“There are just so many harms that the users face,” Baig said last week in an interview. He added that he had informed both the FTC and the Securities and Exchange Commission about the problems. “This is about holding Meta accountable and putting the interests of users first.”   

Meta’s response

 

Meta has strongly denied Baig’s claims. “Sadly, this is a familiar playbook in which a former employee is dismissed for poor performance and then goes public with distorted claims...,” said Carl Woog, WhatsApp’s spokesperson, as quoted by the news report. He stressed that Meta’s team works hard to protect user privacy, calling security “an adversarial space".

 

Meta has faced repeated criticism over data protection. In 2019, the company agreed to a $5 billion fine after the Cambridge Analytica scandal, which revealed how millions of users’ data had been improperly accessed.

 

Following that settlement, Mark Zuckerberg promised major changes, saying privacy would become “central” to Meta’s future. But whistle-blower complaints since then have continued to suggest that the company struggles to balance growth with safety.

 

Growing number of whistle-blowers

 

Baig is not the first to speak out. Other former Meta employees have also accused the company of ignoring user safety:

 

• Virtual reality concerns: A group supported by Whistleblower Aid recently told US regulators that Meta failed to protect children from sexual harassment and grooming on its VR platforms

• Frances Haugen’s testimony: In 2021, former employee Frances Haugen testified before Congress, accusing Meta of knowingly creating harmful products for teenagers

• Other allegations: Former policy leader Sarah Wynn Williams also wrote about misconduct at senior levels, though Meta has denied those claims   

 

WhatsApp’s role in Meta’s business

 

Meta bought WhatsApp in 2014 for $19 billion. The messaging app is now used by more than three billion people, many of whom rely on it for its end-to-end encryption. However, Baig’s lawsuit claims that Meta has not lived up to its promises of protecting privacy.

 

Soon after joining WhatsApp, Baig ran a “red team” test, simulating attacks on the service. He found that around 1,500 employees had unrestricted access to sensitive user data, which he said directly violated the FTC settlement, the news report said.

 

Baig documented “critical cybersecurity problems” in October 2022, warning that failing to act could lead to “severe penalties” and brand damage. He said Meta blocked his team’s proposals, such as preventing profile picture downloads and requiring stronger verification for account recovery.

 

According to Baig, his warnings were ignored. Instead, he faced threats, withheld pay, and negative performance reviews. In February 2023, he was fired. He later filed a complaint with the Occupational Safety and Health Administration, claiming retaliation, The New York Times reported.

 

For Baig, joining WhatsApp had been a dream opportunity. But now, he said, his experience has changed how he views the company. “Meta treats its users like they are just numbers on some dashboard,” he said, as quoted by the news report.