Facebook has revealed the private information of more than 50 million users was exposed after attackers exploited a feature which allowed them to take over users’ accounts.
An engineering team discovered the security issue on September 25, and the investigation is still in its early stages.
The social media company alerted authorities of the breach this week and said it had fixed the vulnerability.
Facebook said it did not know the origin or identity of the attackers but will continue to investigate the major security breach.
More than 90 million users were forced to log out of their accounts on Friday, a safety measure for compromised accounts.
It is unclear whether any accounts were misused or what information was taken by the hackers, Facebook said.
More than two billion people use Facebook every month, while another two billion people use WhatsApp, a messenger service owned by Facebook, and the popular photo-sharing app Instagram.
The hack comes amid intense scrutiny over Facebook’s role in a Russian campaign to spread misinformation ahead of the 2016 US election.
Facebook CEO Mark Zuckerberg was hauled before a US senate committee hearing in April and was grilled by lawmakers over the company’s influence.
The company is also still reeling from the Cambridge Analytica scandal in which the private information of 87 million users was illegally obtained by a British political consulting firm.
“We have a responsibility to protect your data, and if we can’t then we don’t deserve to serve you,” Mr Zuckerberg said in a statement regarding the scandal earlier this year.
The Securities and Exchange Commission has opened an investigation into the Cambridge Analytica scandal in addition to several other federal investigations into the company’s data sharing.
As part of a major campaign to restore the company’s image, Facebook released a short film called in May called “Facing Facts”, which shows how the company is combatting the spread of misinformation.
In August, it removed more than 652 fake accounts with ties to Russia and Iran for attempting to influence world politics.
“Security is not something you ever fully solve,” Mark Zuckerberg told reporters. “We have to constantly keep improving to stay ahead.”