A former Meta engineer based in London is being investigated by the Metropolitan Police after reportedly downloading around 30,000 private Facebook photos from the social network. The suspect, a man in his 30s, is believed to have created a programme able to bypassing the company’s protective systems to retrieve users’ private photographs without permission. He was arrested in November 2025 on suspicion of unauthorized access to computer material and has since been released on bail, with his next police report due in May. Meta uncovered the breach over a year ago, immediately terminated the employee’s position, and informed law enforcement to police. The company has since alerted affected users and strengthened its protective systems.
The Reported Breach of Security and Identification
According to Meta, the security breach came to light more than a year before the arrest, when the company’s systems detected unauthorised access to user photographs. The discovery triggered swift action from Meta’s leadership, who terminated the engineer’s employment and escalated the matter to the authorities. The social media giant subsequently launched an investigation to ascertain the complete scope of the breach and identify which users had been affected by the unauthorised data downloads.
The investigation has since been taken up by the Metropolitan Police’s Cyber Crime Division, following a recommendation from the FBI in the United States. This international cooperation underscores the seriousness of the suspected crime and the cross-border nature of cybercrime investigations. Meta has verified that it informed all impacted users of Facebook whose images were downloaded and has implemented strengthened security measures to prevent comparable events happening in the years ahead.
- Violation uncovered more than twelve months before the defendant’s arrest
- Alleged developer created programme to circumvent protective measures
- London Police Digital Crime Division leading the inquiry
- American agency referral triggered cross-border police collaboration
Law Enforcement Action and Timeline
The Metropolitan Police’s handling of the alleged data breach was prompt after Meta’s referral and the ensuing involvement of American federal authorities. A man in his 30s, living in London, was arrested in November 2025 on suspicion that he committed unauthorised access to computer material. The arrest represented a significant development in what had been an ongoing investigation since Meta first uncovered the breach over a year prior. The suspect’s apprehension demonstrated the gravity with which law enforcement bodies treat allegations of large-scale unauthorised access to private user data.
Following his apprehension, the suspect was released on bail awaiting additional investigation. According to reports from the Press Association, he is obliged to present back to police in May, when investigators will review progress of the investigation. The choice to grant bail rather than custody suggests authorities are continuing their investigation whilst allowing the suspect conditional freedom. This approach is common in complex cybercrime cases where detectives need further time to gather evidence and establish the complete scope of the suspected crime.
Metropolitan Police Investigation
The Metropolitan Police’s Digital Crime Team has taken the lead in investigating the suspected data breach, bringing expert knowledge to bear on what is a highly intricate case. The unit’s involvement reflects the increasingly sophisticated nature of modern data crimes and the need for dedicated officers trained in cybersecurity and digital forensics. Their investigation focuses on determining exactly how the suspect circumvented Meta’s security systems and the methods used to download the photographs.
The examination has been strengthened by cross-border collaboration, with the Federal Bureau of Investigation in the United States escalating the case to British authorities. This cross-Atlantic collaboration highlights how cybercrime transcends country lines and necessitates collaborative enforcement work. The FBI’s participation implies the breach may have had repercussions outside the United Kingdom, likely affecting people in different regions and necessitating collaborative investigation.
Meta’s Security Lapses and Previous Incidents
| Incident | Fine and Details |
|---|---|
| Facebook Data Breach (November 2022) | €265 million (£228 million) fine from Irish Data Protection Commission for publishing personal details of hundreds of millions of users online |
| Unencrypted Password Storage (September 2024) | €91 million (£75 million) fine from Irish Data Protection Commission for inadvertently storing user passwords on internal systems without encryption |
| Addictive Platform Design (March 2025) | $6 million (£4.5 million) damages awarded to user “Kaley” in California court case; both Meta and Google found to have intentionally built addictive platforms harming mental health |
| Unauthorised Photo Download (Current Investigation) | Approximately 30,000 private Facebook images allegedly accessed by former engineer; investigation ongoing by Metropolitan Police Cybercrime Unit |
This recent breach constitutes a troubling pattern of security breaches at Meta, one of the world’s largest technology companies. The event illustrates how even sophisticated digital platforms with significant financial backing can become targets of insider threats when staff members abuse their privileged access to infrastructure. The claimed bypassing of security protocols by the engineer highlights potential vulnerabilities in Meta’s internal safeguards and access controls, prompting concerns about how rigorously the company monitors employee activities and protects private customer information from malicious actors within the organisation.
Growing Concerns Regarding Tech Company Accountability
The investigation into the ex-Meta engineer comes at a time of heightened scrutiny over how technology companies safeguard user data and protect their platforms from internal threats. Meta’s ongoing security breaches have prompted regulators across multiple jurisdictions to examine whether the firm’s compliance measures are sufficiently robust. The cumulative effect of these occurrences—from the massive 2022 data breach to the current photo download scandal—suggests that despite significant spending in security infrastructure, Meta may still struggle to prevent determined individuals from exploiting system vulnerabilities. Commentators contend that the company’s reactive approach, acting solely following breaches are discovered, fails to meet the forward-thinking security approach required by organisations handling billions of people’s private data.
Beyond Meta’s particular failings, the case presents broader questions about responsibility in the digital sector. As social media platforms exert unprecedented influence over users’ personal data and mental health, regulators and policymakers are growing more skeptical of whether existing fines and legal penalties effectively discourage wrongdoing. The divergent methods adopted by multiple regulators—the Irish Data Protection Commission, American courts, and now the Metropolitan Police—underscore the disjointed structure of tech regulation worldwide. Some observers contend that enhanced regulatory standards, required security reviews, and tighter controls of employee access to protected data could prevent further occurrences, whilst others argue that companies must face greater monetary penalties to justify the commitment to genuine security improvements.
- Regulators internationally are intensifying scrutiny of Meta’s data protection procedures and compliance standards
- Existing fines might be insufficient to prevent big tech organisations from neglecting data security safeguards
- Coordinated cross-border regulatory frameworks could strengthen defences from insider threats and data breaches