WhatsApp’s former head of security sued the app’s parent company, Meta, and its executives Sept. 8, alleging he discovered security and privacy issues that he says the company’s leadership ignored.
Tech Policy Press reported that Attaullah Baig’s complaint, filed in the US District Court for the Northern District of California, claims that Meta violated a 2002 federal law by failing to disclose information security problems or weaknesses in information security internal controls. Baig alleges that the company violated Securities and Exchange Commission (SEC) laws relating to internal controls and also claims that the company potentially committed shareholder fraud by illegally withholding disclosure of information security issues.
According to the complaint, Baig began working as WhatsApp head of security in 2021 and found that approximately 1,500 of the app’s engineers had unrestricted access to user data “and could move or steal such data without detection or audit trail.” He also discovered that about 100,000 WhatsApp accounts are compromised daily.
Additionally, Baig found that “WhatsApp lacked fundamental cybersecurity knowledge required for regulatory compliance” regarding the collection and storage of user data and brought his concerns to his supervisor.
Baig began meeting with WhatsApp executives to discuss the security failures and continued to raise concerns about cybersecurity gaps for years “despite intensifying retaliation from management and systemic abuse,” according to the complaint. During that time, he helped devise solutions to WhatsApp’s security problems, especially for mitigating the number of hacked accounts and impersonations, according to Tech Policy Press.
He eventually sent letters to Meta CEO Mark Zuckerberg detailing his claims and filed a complaint with the SEC. According to court documents, Baig also filed a complaint with the Department of Labor’s Occupational Safety and Health Administration over the retaliation with which he claims his allegations were met. He was fired from the company in February 2025.
Tech Policy Press reported that Baig’s suit seeks compensation from damages and reinstatement at his job, and also asks the court to determine whether Meta violated federal law.