Reading Time: 3 minutes

WhatsApp has long positioned itself as a secure messaging platform with end-to-end encryption. However, recent findings by cybersecurity researchers have raised serious concerns about how public data can still be scraped at scale. A new report revealed that the profile photos, phone numbers, and online statuses of crores of Indian users were exposed through automated scraping—without hacking WhatsApp’s servers. This incident highlights a critical gap in user awareness and platform safeguards.

Image source: https://www.pexels.com/photo/a-person-holding-a-cellphone-with-logo-on-the-screen-4132538/

Below is a detailed breakdown of how this happened and why it’s a major privacy concern.

1. WhatsApp’s “Public Info” Loophole: How Scraping Became Possible

Even though chats are encrypted, certain user details—such as profile photos, usernames, and “About” info—are visible to anyone whose number you have saved.
Researchers demonstrated that if someone has a massive database of Indian mobile numbers, they can:

• Automatically upload them into WhatsApp
• Check which numbers are active on the platform
• Collect publicly visible profile pictures and names
• Track online/offline activity

This means no hacking or malware is required; the platform’s own design allows this visibility.

2. How Researchers Scraped Data from Crores of Users

Security researchers used automated scripts and virtual devices to observe how WhatsApp handles contacts. Their method involved:

• Generating or collecting millions of Indian mobile numbers
• Syncing them to WhatsApp contacts
• Scraping the available public data
• Storing profile photos, names, about text, and last-seen/online status

Since It does not limit how many contacts can be queried by an account, determined scrapers can operate on a large scale.

The researchers also found no strong rate-limiting, making it possible to collect data from hundreds of millions of accounts.

3. Why This Is Dangerous: Real-World Risks for Indian Users

The exposure of profile photos and numbers from crores of users poses significant risks:

• Identity Theft

Attackers can use your picture and name for impersonation, fake profiles, or scams.

• Targeted Phishing & Fraud

Fraudsters can craft personalized WhatsApp scams, pretending to be friends or family.

• Surveillance & Stalking

Online status tracking can reveal sleeping patterns, daily routines, or relationships.

• Spam & Telemarketing Abuse

Scraped numbers can be fed to marketing and scam call centers.

4. Why WhatsApp Hasn’t Fixed This Yet

Meta (WhatsApp’s parent company) claims that the platform shows only the data users choose to make visible.
However, researchers argue:

• The default settings are too open
  
• It doesn’t sufficiently warn users
  
• The platform lacks detection systems for large-scale scraping
  
• Privacy settings are buried and not user-friendly

In short, WhatsApp’s design prioritizes convenience and discoverability over strict privacy—for now.

5. How Indian Users Can Protect Themselves Today

Until WhatsApp implements stronger protections, users can take crucial steps:

Change Privacy Settings Immediately

Go to:

• Settings → Privacy
• Profile Photo → My Contacts or Nobody
• About → My Contacts
• Last Seen & Online → Nobody
• Groups → My Contacts / My Contacts Except…
• Disable “Read Receipts”
  

Avoid Using Personal Photos

Use a neutral or non-identifiable picture.

Enable Two-Step Verification

Protects your account from SIM swap and device takeover attacks.

Don’t Accept Unknown Messages or Calls

Block and report suspicious accounts instantly.

Conclusion

The large-scale scraping of data from crores of Indian users exposes a critical flaw in how the platform handles publicly visible information. Although end-to-end encryption protects chat content, profile photos and online statuses remain vulnerable due to permissive privacy defaults and the lack of anti-scraping protections.

This incident is a wake-up call for Indian users to take privacy settings seriously and for WhatsApp to introduce stronger safeguards. In a country where over 500 million people rely on WhatsApp daily, protecting user identity and personal information must become a top priority.