Researchers reveal WhatsApp enumeration flaw affecting 3.5 billions of potential accounts

Researchers from the University of Vienna recently disclosed a technique that allowed them to enumerate 3.5 billion possible WhatsApp account numbers across 245 countries. Their method generated large phone number combinations and queried WhatsApp servers at speeds exceeding 100 million numbers per hour, bypassing expected rate limits without being blocked.

They collected data such as timestamps and public encryption keys, which allowed inferences about account age, operating system, and linked devices. Public profile photos and about text were also visible when users had set this information to be accessible to everyone, though no messages or contacts were exposed.

Meta clarified that the researchers did not obtain 3.5 billion real numbers but identified which generated numbers matched active WhatsApp accounts. The study also showed that nearly half of the numbers from the 2021 Facebook leak remained active on WhatsApp. Meta reported no evidence of malicious use, confirmed that the researchers deleted all data, and said server side mitigations began rolling out in September 2025 with more protections added in October. However, if that’s not enough you can always check our catalog of safer WhatsApp alternatives like Signal, Wire or Threema.