Former Security Chief Files Lawsuit Against Meta Over WhatsApp Data Security and Retaliation Claims

Meta is facing fresh scrutiny after former employee Attaullah Baig filed a lawsuit alleging that the company violated privacy regulations and securities laws, and that he was fired in retaliation for raising these concerns.

According to the complaint, nearly 1,500 engineers had unrestricted access to sensitive user data such as messages, locations, contact lists, and profile photos—without proper oversight. Baig argues this practice breached Meta’s 2020 privacy settlement with the U.S. Federal Trade Commission (FTC). His internal tests reportedly revealed as many as 500,000 compromised WhatsApp accounts daily.

The lawsuit further claims Meta failed to enforce basic security measures, including monitoring and remediation protocols. Baig alleges he personally raised these issues with senior executives, including CEO Mark Zuckerberg and WhatsApp chief Will Cathcart, but his concerns were dismissed.

Baig says he faced retaliation after highlighting six critical cybersecurity failures in October 2022. The complaint states his performance reviews were downgraded, projects obstructed, and ultimately, he was terminated in February 2025. He has also filed complaints with the SEC and OSHA, and partnered with non-profit Psst.org, which “keeps a check on the powerful.”

In response, Meta denied the allegations, calling Baig a disgruntled former employee and attributing his claims to a “familiar playbook.” The company maintains its security practices are strong and accuses Baig of misrepresenting the security team’s work.

Baig’s case echoes other high-profile whistleblower complaints in Big Tech, drawing comparisons to Twitter’s former security chief Peiter “Mudge” Zatko, and adding to concerns over how major platforms balance user privacy with business growth.