A previously employed Meta engineer residing in London is under investigation by the Met Police after allegedly acquiring approximately 30,000 private Facebook photos from the social network. The suspect, a man in his 30s, is thought to have developed a tool able to circumventing the company’s protective systems to access users’ private photographs unauthorised. He was apprehended in November 2025 on suspicion of unauthorized access to computer material and has since been freed on bail, with his next police report due in May. Meta uncovered the breach approximately a year ago, swiftly terminated the employee’s employment, and informed law enforcement to police. The company has since alerted affected users and enhanced its security systems.
The Alleged Breach and Identification
According to Meta, the data breach came to light more than a year before the arrest, when the company’s systems detected unauthorised access to user photographs. The discovery led to immediate response from Meta’s leadership, who terminated the engineer’s employment and escalated the matter to the authorities. The social media giant subsequently conducted an investigation to determine the full scope of the breach and determine which users had been affected by the unauthorised data downloads.
The investigation has subsequently been assumed by the Metropolitan Police’s Cyber Crime Division, following a referral from the FBI in the US. This international cooperation highlights the seriousness of the suspected crime and the international scope of cyber crime enquiries. Meta has confirmed that it notified all impacted users of Facebook from whom images were obtained and has introduced strengthened security measures to avoid comparable events happening in future.
- Violation uncovered over one year prior to the suspect’s arrest
- Suspected engineer created programme to circumvent security checks
- Metropolitan Police Cybercrime Unit leading the inquiry
- American agency referral prompted international law enforcement collaboration
Police Response and Timeline
The Metropolitan Police’s handling of the reported data breach was swift after Meta’s referral and the ensuing engagement of American federal law enforcement. A man in his 30s, living in London, was arrested in November 2025 on suspicion of unauthorised access to computer material. The arrest marked a major milestone in what had been an active investigation since Meta first uncovered the breach more than twelve months prior. The suspect’s arrest highlighted the seriousness with which law enforcement bodies treat allegations of large-scale unauthorised access to private user data.
Following his apprehension, the suspect was released on bail pending additional investigation. According to reports from the Press Association, he is required to report back to police in May, when investigators will evaluate progress of the investigation. The choice to grant bail rather than custody suggests authorities are continuing their investigation whilst allowing the suspect limited liberty. This method is common in intricate cyber-related investigations where investigators need further time to collect information and establish the complete scope of the alleged offence.
London Police Investigation
The Metropolitan Police’s Digital Crime Team has spearheaded investigating the alleged breach, bringing expert knowledge to bear on what is a technically complex case. The unit’s involvement reflects the increasingly sophisticated nature of modern data crimes and the requirement of specialist personnel trained in digital forensics and cybersecurity matters. Their investigation focuses on determining exactly how the individual in question circumvented Meta’s security infrastructure and the methods used to obtain the photographs.
The inquiry has benefited from cross-border collaboration, with the FBI in the United States escalating the case to UK law enforcement. This transatlantic partnership demonstrates how cybercrime transcends country lines and requires coordinated law enforcement efforts. The FBI’s participation implies the attack may have caused consequences outside the United Kingdom, potentially affecting users across multiple jurisdictions and requiring coordinated investigative work.
Meta’s Security Lapses and Past Events
| Incident | Fine and Details |
|---|---|
| Facebook Data Breach (November 2022) | €265 million (£228 million) fine from Irish Data Protection Commission for publishing personal details of hundreds of millions of users online |
| Unencrypted Password Storage (September 2024) | €91 million (£75 million) fine from Irish Data Protection Commission for inadvertently storing user passwords on internal systems without encryption |
| Addictive Platform Design (March 2025) | $6 million (£4.5 million) damages awarded to user “Kaley” in California court case; both Meta and Google found to have intentionally built addictive platforms harming mental health |
| Unauthorised Photo Download (Current Investigation) | Approximately 30,000 private Facebook images allegedly accessed by former engineer; investigation ongoing by Metropolitan Police Cybercrime Unit |
This latest breach constitutes a troubling pattern of security breaches at Meta, one of the world’s largest tech firms. The event illustrates how even sophisticated digital platforms with substantial resources can become targets of internal security risks when staff members abuse their elevated permissions to systems. The alleged circumvention of security protocols by the engineer underscores potential vulnerabilities in Meta’s internal safeguards and access controls, prompting concerns about how thoroughly the company oversees staff conduct and safeguards private customer information from malicious actors within the organisation.
Growing Concerns Regarding Tech Company Oversight
The investigation into the former Meta engineer comes at a time of heightened scrutiny over how technology companies safeguard user data and defend their systems from internal threats. Meta’s repeated security failures have prompted regulators across various regions to assess whether the firm’s regulatory safeguards are sufficiently robust. The cumulative effect of these occurrences—from the large-scale 2022 data leak to the current photo download scandal—suggests that despite significant spending in security infrastructure, Meta may continue to find it difficult to prevent determined individuals from taking advantage of security weaknesses. Commentators contend that the company’s reactive approach, responding only after breaches are uncovered, falls short of the forward-thinking security approach necessary for companies managing billions of people’s private data.
Beyond Meta’s particular failings, the case presents fundamental issues about accountability in the tech industry. As social media platforms exert unprecedented influence over users’ data privacy and psychological wellbeing, regulators and policymakers are growing more skeptical of whether current penalties and enforcement measures effectively discourage wrongdoing. The varying approaches taken by different authorities—the Irish Data Protection Commission, American courts, and now the Metropolitan Police—underscore the piecemeal character of tech regulation worldwide. Some observers argue that tougher legal obligations, compulsory audits, and tighter controls of employee access to protected data could forestall future incidents, whilst others assert that companies must encounter heftier financial repercussions to justify the investment in authentic security enhancements.
- Regulators internationally are intensifying scrutiny of Meta’s data protection procedures and compliance standards
- Existing fines could be insufficient to deter large technology companies from overlooking user data protection
- Coordinated global regulatory cooperation could strengthen defences against insider threats and data breaches