A former Meta engineer residing in London is being investigated by the Metropolitan Police after allegedly obtaining roughly 30,000 personal Facebook photos from the social media platform. The suspect, a man in his 30s, is said to have designed a tool capable of evading the company’s security systems to access users’ private photos unauthorised. He was apprehended in November 2025 on suspicion of unauthorised access computer material and has since been freed on bail, with his next police report due in May. Meta uncovered the breach more than a year ago, promptly ended the employee’s position, and informed law enforcement to law enforcement. The company has since informed users affected and strengthened its security systems.
The Alleged Breach of Security and Detection
According to Meta, the unauthorised access came to light more than a year before the arrest, when the company’s systems detected unauthorised access to user photographs. The discovery prompted immediate action from Meta’s leadership, who terminated the engineer’s employment and escalated the matter to the authorities. The social media giant subsequently launched an investigation to ascertain the complete scope of the breach and identify which users had been affected by the unauthorised downloads.
The enquiry has subsequently been assumed by the Metropolitan Police’s Cyber Crime Division, in response to a referral from the FBI in the United States. This international cooperation underscores the severity of the alleged offence and the international scope of cybercrime investigations. Meta has confirmed that it informed all impacted users of Facebook whose images were downloaded and has implemented enhanced security protocols to prevent similar incidents occurring in future.
- Breach identified over one year prior to the suspect’s arrest
- Alleged developer designed system to bypass protective measures
- Metropolitan Police Digital Crime Division leading the inquiry
- FBI referral prompted cross-border police collaboration
Law Enforcement Response and Timeline
The Metropolitan Police’s handling of the reported data breach was prompt after Meta’s referral and the subsequent involvement of American federal authorities. A man in his 30s, living in London, was arrested in November 2025 on suspicion that he committed unauthorised access to computer material. The arrest marked a major milestone in what had been an active investigation since Meta first uncovered the breach more than twelve months prior. The suspect’s arrest highlighted the seriousness with which law enforcement bodies treat claims regarding large-scale unauthorised access to personal user information.
Following his detention, the suspect was released on bail pending additional investigation. According to reports from the Press Association, he is obliged to present back to police in May, when detectives will review progress of the investigation. The decision to release on bail rather than custody indicates authorities are pursuing their enquiries whilst granting the suspect conditional freedom. This approach is typical in intricate cyber-related investigations where investigators need further time to collect information and establish the full extent of the alleged offence.
London Police Inquiry
The Metropolitan Police’s Cybercrime Unit has taken the lead in investigating the suspected data breach, bringing specialist expertise to bear on what is a highly intricate case. The unit’s involvement reflects the growing complexity of nature of modern data crimes and the requirement of specialist personnel trained in digital forensics and cybersecurity matters. Their investigation focuses on determining exactly how the individual in question circumvented Meta’s security systems and the techniques employed to obtain the photographs.
The inquiry has benefited from global partnership, with the Federal Bureau of Investigation in the United States referring the matter to UK law enforcement. This cross-Atlantic collaboration highlights how cyber attacks cross international boundaries and requires collaborative enforcement work. The FBI’s participation indicates the incident could have had implications beyond the United Kingdom, potentially affecting users across multiple jurisdictions and requiring joint investigative efforts.
Meta’s Security Failures and Previous Incidents
| Incident | Fine and Details |
|---|---|
| Facebook Data Breach (November 2022) | €265 million (£228 million) fine from Irish Data Protection Commission for publishing personal details of hundreds of millions of users online |
| Unencrypted Password Storage (September 2024) | €91 million (£75 million) fine from Irish Data Protection Commission for inadvertently storing user passwords on internal systems without encryption |
| Addictive Platform Design (March 2025) | $6 million (£4.5 million) damages awarded to user “Kaley” in California court case; both Meta and Google found to have intentionally built addictive platforms harming mental health |
| Unauthorised Photo Download (Current Investigation) | Approximately 30,000 private Facebook images allegedly accessed by former engineer; investigation ongoing by Metropolitan Police Cybercrime Unit |
This latest breach constitutes a troubling pattern of security breaches at Meta, one of the world’s largest tech firms. The event demonstrates how even advanced online systems with significant financial backing can become targets of internal security risks when staff members abuse their privileged access to systems. The alleged circumvention of security protocols by the engineer highlights possible security weaknesses in Meta’s internal safeguards and access controls, prompting concerns about how rigorously the company oversees staff conduct and protects sensitive user data from malicious actors within the organisation.
Broader Worries Regarding Digital Platform Oversight
The investigation into the ex-Meta engineer comes at a period of increased scrutiny over how tech firms safeguard user data and protect their platforms from internal threats. Meta’s repeated security failures have spurred regulatory bodies across various regions to examine whether the firm’s compliance measures are adequately stringent. The cumulative effect of these incidents—from the large-scale 2022 data leak to the current photo download scandal—suggests that despite significant spending in security infrastructure, Meta may still struggle to stop motivated actors from exploiting system vulnerabilities. Critics argue that the company’s reactive approach, acting solely following breaches are uncovered, fails to meet the forward-thinking security approach necessary for organisations handling billions of people’s private data.
Beyond Meta’s particular failings, the case presents broader questions about oversight in the digital sector. As social media platforms exert unprecedented influence over users’ private information and psychological wellbeing, regulators and policymakers are increasingly questioning whether current penalties and enforcement measures adequately deter wrongdoing. The divergent methods employed by multiple regulators—the Irish Data Protection Commission, American courts, and now the Metropolitan Police—demonstrate the disjointed structure of technology oversight internationally. Some observers maintain that stronger statutory requirements, required security reviews, and tighter controls of employee access to sensitive systems could prevent subsequent breaches, whilst others contend that companies must incur greater monetary penalties to support the investment in real security upgrades.
- Regulators across the globe are tightening scrutiny of Meta’s security measures and compliance standards
- Existing fines might be insufficient to deter major tech firms from overlooking user data protection
- Coordinated global regulatory cooperation could bolster defences from insider threats and unauthorised data access