It started with a growing unease. When Attaullah Baig joined Meta in 2021 as a software engineering manager, he eventually became the Head of Security for WhatsApp. But the system he found wasn’t a fortress; it was a security nightmare. Baig says he uncovered glaring vulnerabilities that would alarm any cybersecurity expert.
According to a federal lawsuit filed this week, Baig discovered what he calls “systemic cybersecurity failures” at WhatsApp. The most significant issue: approximately 1,500 engineers allegedly had unrestricted access to user data. This level of access, if exploited, would allow them to transfer or steal information without being detected. For a company built on a foundation of privacy, this was a disturbing discovery.
Baig claims he spoke up immediately. He says he raised his concerns with his boss at least five times, warning that WhatsApp’s security practices were so lax they couldn’t meet regulatory standards. He also states he escalated his findings to higher management, even informing Meta CEO Mark Zuckerberg about the flaws.
Baig claims that instead of fixing the problems, the company retaliated against him. He alleges he soon received poor performance reviews and that Meta ultimately fired him. According to Baig, his termination wasn’t about his work performance but about his constant insistence on exposing uncomfortable truths.
The lawsuit presents even more serious allegations. Baig claims that WhatsApp lacked a 24/7 security operations centre and that approximately 100,000 users’ accounts were taken over daily. He also states that the company employed fewer security engineers than similar-sized companies, a gap that left it highly vulnerable to breaches. If proven true, these allegations could place Meta in violation of its 2020 settlement with the Federal Trade Commission.
Meta, however, is not backing down. “Sadly, this is a familiar playbook,” said WhatsApp spokesperson Carl Woog, who framed Baig as a disgruntled ex-employee fabricating a story after his poor performance led to his dismissal. Another spokesperson, Zade Alsawah, highlighted that the Department of Labour’s Occupational Safety and Health Administration (OSHA) had already reviewed Baig’s complaint and found no evidence of retaliation.
Baig, however, offers a different version of events: one where he gave clear warnings that the company ignored, creating a culture that minimised risks to user trust. This case is a stark reminder of how fragile “end-to-end encryption” can be when the systems protecting it aren’t secure.
This lawsuit comes at a time when data breaches are a common topic and public trust in tech companies is at an all-time low. If Baig’s claims are true, WhatsApp, an app used by more than 2 billion people, may have to answer for more than just its security flaws. It may also have to explain why it didn’t listen to internal warnings.
For every WhatsApp user who has ever typed something sensitive into a chat window, the story raises a disturbing question: what happens to privacy when the very people tasked with protecting it are silenced?
