A former senior security executive at WhatsApp has filed a federal lawsuit accusing parent company Meta of failing to meet cybersecurity obligations and retaliating against him for raising concerns.
Attaullah Baig, who worked at WhatsApp from 2021 to 2025, alleges that about 1,500 engineers had unrestricted access to user data without proper oversight. He claims this could violate a 2020 United States government order that fined Meta 5 billion dollars for privacy failures.
According to the 115-page filing in a San Francisco federal court, Baig found through internal testing that WhatsApp engineers could “move or steal user data,” such as profile photos, IP addresses, and contact details, without any detection or audit record. He says he repeatedly raised these concerns with senior leaders, including WhatsApp head Will Cathcart and Meta CEO Mark Zuckerberg.
The lawsuit states that Baig faced retaliation after his reports, including poor performance reviews and verbal warnings, before being dismissed in February 2025 for alleged “poor performance.” He also claims Meta blocked the rollout of security features designed to tackle account takeovers that reportedly affected around 100,000 WhatsApp users each day, prioritising growth instead.
Meta has strongly rejected the claims. “Sadly, this is a familiar playbook in which a former employee is dismissed for poor performance and then goes public with distorted claims that misrepresent the ongoing hard work of our team,” said Carl Woog, vice president of communications at WhatsApp. He added, “Security is an adversarial space, and we pride ourselves on building on our strong record of protecting people’s privacy.”
The company argues Baig exaggerated his role, saying he was not head of security but a lower-level engineer, and insists his departure was due to performance issues confirmed by multiple senior colleagues. Meta also pointed out that a United States labour authority had dismissed Baig’s earlier complaint, ruling there was no retaliation.
Baig, who previously held cybersecurity roles at PayPal and Capital One, is seeking reinstatement, back pay, damages, and possible regulatory action.
The case comes as Meta continues to face scrutiny over its data handling across Facebook, Instagram, and WhatsApp, and follows the company’s 2020 settlement tied to the Cambridge Analytica scandal.
Also read: Viksit Workforce for a Viksit Bharat
Do Follow: The Mainstream formerly known as CIO News LinkedIn Account | The Mainstream formerly known as CIO News Facebook | The Mainstream formerly known as CIO News Youtube | The Mainstream formerly known as CIO News Twitter |The Mainstream formerly known as CIO News Whatsapp Channel | The Mainstream formerly known as CIO News Instagram
About us:
The Mainstream formerly known as CIO News is a premier platform dedicated to delivering latest news, updates, and insights from the tech industry. With its strong foundation of intellectual property and thought leadership, the platform is well-positioned to stay ahead of the curve and lead conversations about how technology shapes our world. From its early days as CIO News to its rebranding as The Mainstream on November 28, 2024, it has been expanding its global reach, targeting key markets in the Middle East & Africa, ASEAN, the USA, and the UK. The Mainstream is a vision to put technology at the center of every conversation, inspiring professionals and organizations to embrace the future of tech.
