You can argue that they shouldn't have made that mistake, and I'd agree, but stupidity is always more likely than malice.

It's interesting how the supposedly smartest companies of the world are so regularly so stupid in such consistent ways.

They're never stupid in a "oh no we deleted all your personal information from our system and now can't track you anymore" way, weirdly.

More generally, remember that you could be one of those megacorp employees one day, and you might build a 2fa system which logged to a particular place.

Later (remember the company is growing for 50% for many years) some new person sees the phone numbers and doesn't realise their provenance (very likely culturally at a place like FB, where things are default open) someone else finds the phone numbers and uses them to send marketing messages.

Like, that's what happened (most likely) but it amazes me that people will always want understanding for their own mistakes, but regularly disclaim that others shouldn't have done it, or made a mistake maliciously.

To be clear, I have no special insight here, but I think that assuming everything is malice and pre-planned is a less fruitful headspace to inhabit than realising that everyone is human, all companies make mistakes and that's a good prior.

To be even clearer, FB should have made this bug impossible (and I'm sure they have now), but given the amount of mistakes I've made I hesitate to cast the first (or indeed one of the last I suppose) stone.

And what happens if it's revealed? How large are fines, how long the prison time?

Or just keep a hash of the number as GP described.