Between 200 million and 600 million Facebook users were affected, and over 20,000 Facebook employees had access to the passwords, according to a source at Facebook who spoke with cybersecurity reporter Brian Krebs. In a blog post following Krebs’s report, Facebook said “hundreds of millions” of users were affected, but that it had found no evidence that employees had “internally abused or improperly accessed them.” The Irish data protection office, which has jurisdiction over Facebook’s European operations, said it is “currently seeking further information” from the company. (Krebs on Security, Facebook)

Talking point: Storing passwords properly is simple, but tech companies keep struggling to do it. In May 2018, Twitter and GitHub both announced they had been storing passwords in plain text due to bugs. Unlike them, Facebook doesn’t attribute the plain-text password storage to a bug. The company hasn’t offered an explanation for why this happened, which has in the past been its first instinct at the beginning of a crisis. This is the latest bad news for the company, which is currently facing a criminal investigation and several government inquiries over its handling of user information.