Former WhatsApp security executive Attaullah Baig sued Meta in September 2025, alleging that serious weaknesses in WhatsApp's internal cybersecurity and data-governance systems went uncorrected even after he repeatedly warned senior leaders about them. His complaint also alleges that Meta retaliated against him for raising those concerns and ultimately dismissed him in February 2025.
The case is important, but some of the most dramatic claims surrounding it require careful qualification. Baig's allegations concern matters such as employee access to stored user information, account takeovers, profile scraping, breach detection, regulatory compliance and Meta's disclosures to investors. They do not, by themselves, establish that WhatsApp's end-to-end encryption was secretly broken or that Meta employees could routinely read the plaintext contents of billions of private chats.
Meta has denied Baig's characterization of its security practices. A WhatsApp representative told Ars Technica that the former employee had been dismissed for poor performance and described his claims as distorted. The company also said that its teams had reviewed concerns he raised while employed and found some of them overly broad or duplicative of work already underway.
What Baig's Lawsuit Actually Alleges
Baig became WhatsApp's head of security in 2021. According to court records, he says he soon identified deficiencies involving data inventory, employee access controls, monitoring, breach detection and account security. He later argued that those problems conflicted with privacy obligations imposed on Meta under a major Federal Trade Commission settlement.
One of his most serious allegations was that roughly 1,500 engineers could access or move sensitive WhatsApp user data without sufficient monitoring or an adequate audit trail. In a September 2026 ruling, the federal court summarized Baig's allegation as a warning that about 1,500 engineers could potentially "move or steal user data undetected."
That distinction matters. The allegation concerns access to user data inside Meta's infrastructure; it is not the same as proving that 1,500 employees could decrypt the contents of ordinary end-to-end encrypted WhatsApp messages.
The Lawsuit Does Not Prove WhatsApp's Encryption Was Broken
WhatsApp has used end-to-end encryption by default for personal messages and calls since 2016. The service relies on the Signal Protocol, which is designed so that message content is encrypted on the sender's device and can be decrypted only by intended recipients.
WhatsApp continues to state that neither WhatsApp nor Meta can read ordinary personal messages protected by that encryption. Its current privacy explanation says personal one-to-one and group messages are secured before leaving a user's device and cannot be read by someone outside the chat.
End-to-end encryption, however, does not mean every piece of information associated with an account is inaccessible to the platform. Services still operate account systems, anti-abuse tools, contact and device infrastructure, profile information and other metadata or server-side systems. A weakness in those systems can therefore create serious privacy or security risks without representing a cryptographic failure in the Signal Protocol itself.
Baig's complaint is better understood as alleging failures in those surrounding security and data-governance controls rather than demonstrating a universal backdoor into encrypted conversations.
Account Takeovers Allegedly Rose to 400,000 Per Day
Baig also alleged unusually high levels of account takeover activity. According to the federal court's summary of his claims, he reported approximately 100,000 daily account compromises in 2022. His complaint later alleged that as many as 400,000 users per day were being locked out of their accounts because of account takeovers by 2024.
Those numbers are allegations made by Baig, not an independently verified measurement of successful WhatsApp breaches. They also should not be interpreted as evidence that attackers were defeating WhatsApp's end-to-end encryption hundreds of thousands of times per day. Account takeover can occur through methods such as stolen verification credentials, social engineering or other attacks against account authentication rather than by breaking the encryption protecting messages in transit.
WhatsApp has continued adding account protections. By August 2026, the company said more than one billion users had enabled passkeys, and it announced stronger two-step verification options designed to make unauthorized account access more difficult.
Baig Also Raised Concerns About Massive Profile Scraping
Another part of the dispute involves scraping rather than message decryption. Baig alleged that WhatsApp's protections allowed profile information to be collected at enormous scale and claimed that hundreds of millions of profile photos could be scraped each day.
The September 2026 court order says Baig reported internally that WhatsApp was exposing information on potentially millions or billions of users through scraping and that approximately 400 million profile photos were being scraped daily. Again, these figures reflect Baig's allegations and have not been established by a final judgment.
Scraping can still create meaningful privacy risks even when encrypted message content remains protected. Public or discoverable profile information can potentially be harvested for impersonation, fraud, spam or social-engineering campaigns.
Why the 2019 FTC Privacy Settlement Matters
Baig repeatedly connected his concerns to Meta's obligations under its landmark settlement with the U.S. Federal Trade Commission. In 2019, Facebook agreed to pay a record $5 billion penalty and accept extensive new privacy requirements following allegations that it had violated an earlier FTC privacy order.
The FTC said the settlement required a comprehensive privacy program, stronger oversight and new accountability mechanisms. Importantly, those requirements extend to Facebook-owned services including WhatsApp and Instagram.
The order also requires documentation and review of privacy risks and requires the company to maintain a comprehensive data-security program. Baig argues that weaknesses he observed at WhatsApp were inconsistent with those commitments.
Whether Meta actually violated the FTC order in the ways Baig alleges is a separate legal and regulatory question. His lawsuit does not itself constitute a finding by the FTC that Meta breached the settlement.
The Case Has Changed Significantly Since It Was Filed
Baig filed the federal case in the U.S. District Court for the Northern District of California on September 8, 2025 under the whistleblower-protection provisions of the Sarbanes-Oxley Act. His theory was not simply that Meta had poor cybersecurity. He alleged that he was retaliated against for reporting conduct that he believed implicated federal securities laws and Meta's disclosures to investors.
In March 2026, the court dismissed his initial Sarbanes-Oxley retaliation claim without prejudice, finding that the complaint had not adequately connected several of his cybersecurity concerns to conduct protected by that law. Baig was allowed to amend his case.
A major development followed on September 18, 2026. In an order addressing Baig's second amended complaint, the court ruled that one part of his whistleblower theory could proceed.
The judge found that Baig had plausibly alleged protected activity when he reported that Meta's filings with the Securities and Exchange Commission misrepresented the company's FTC-mandated privacy program and cybersecurity risks. The court said someone with Baig's training and experience could reasonably have believed the disclosures were materially misleading.
That surviving theory was allowed to continue against Meta and several individual defendants, including Nitin Gupta, Pinaki Mukerji and Mark Tsimelzon. Other theories were dismissed. The court also dismissed the claims against Mark Zuckerberg and WhatsApp head Will Cathcart because the complaint did not plausibly allege that either personally participated in an adverse employment action against Baig.
The ruling was procedural, not a determination that Baig's underlying allegations are true. The court ordered him to file a narrower third amended complaint focused on the surviving theory. As of late September 2026, the litigation therefore remained unresolved.
What the Case Means for WhatsApp Users
For WhatsApp's more than three billion users, the lawsuit highlights an important distinction between message encryption and the broader security of a communications platform.
Strong end-to-end encryption can prevent a platform operator or network attacker from reading ordinary message contents while they are being transmitted, but it does not eliminate every other risk. Account authentication, employee permissions, metadata, profile visibility, abuse prevention, backups and endpoint security all matter as well.
Nothing in the court's rulings so far establishes that WhatsApp secretly disabled end-to-end encryption for its user base. At the same time, Baig's allegations concerning internal access controls, account takeovers, scraping and regulatory reporting are substantial enough to have generated continuing federal litigation.
Users can reduce account-takeover risk by enabling WhatsApp's strongest available authentication options, protecting device access, avoiding requests to share verification credentials and treating unexpected messages asking for money or account information with caution.
What Remains Unresolved
The central factual questions remain contested. Baig says Meta failed to adequately address cybersecurity and privacy problems that he raised internally and retaliated when he persisted. Meta says his portrayal is inaccurate, that security concerns were evaluated and that his employment ended because of performance problems.
The September 2026 ruling did not decide which side is correct. It determined only that one portion of Baig's amended whistleblower case was sufficiently pleaded to move forward while rejecting numerous other theories.
That makes the lawsuit significant for reasons more precise than claims of a proven WhatsApp encryption collapse: it tests whether a former senior security employee can show that Meta's public cybersecurity and privacy disclosures conflicted materially with conditions he says existed inside WhatsApp, and whether he suffered unlawful retaliation for reporting those concerns.
Read More:
0 Comments