An ex-WhatsApp executive sues Meta over security failures, filing a lawsuit in federal court in San Francisco. Attaullah Baig, who served as WhatsApp’s head of security from 2021 to 2025, alleges the company ignored critical cybersecurity measures and retaliated against him for raising alarms.
Baig claims that nearly 1,500 engineers had unchecked access to user data, including IP addresses, profile photos, and contacts. He argues this practice violates a 2020 U.S. government order that cost Meta $5 billion in penalties. The lawsuit also states that Meta blocked security upgrades that could have reduced account takeovers, affecting over 100,000 users daily.
According to Baig, senior leaders, including WhatsApp head Will Cathcart and Meta CEO Mark Zuckerberg, were informed of these issues. He alleges that instead of addressing the problems, Meta retaliated with poor performance reviews and eventually terminated him in February 2025.
Meta has strongly denied the charges. Company spokesperson Carl Woog said Baig was dismissed for poor performance and that his claims distort the truth. The company also noted that regulators previously dismissed his retaliation complaint.
The case adds to growing scrutiny of Meta’s handling of user data and security practices across its platforms.
