Who Is Attaullah Baig? The Ex-WhatsApp Security Boss Exposing Meta's Alarming Privacy Secrets

Attaullah Baig is an Indian-origin cybersecurity expert who served as WhatsApp's head of security from 2021 until early 2025. Known for his expertise at companies like PayPal, Capital One, and Whole Foods Market, Baig joined Meta with a mission to strengthen WhatsApp's security. However, he soon uncovered critical failures that he says put billions of users' data at risk.

In 2021, shortly after joining Meta, Baig led a red-team exercise revealing that around 1,500 WhatsApp engineers had unlimited access to sensitive user data, including contact details, IP addresses, and profile photos, without proper controls or audit trails. This, he alleges, violated a 2020 Federal Trade Commission order designed to protect user privacy after the Cambridge Analytica scandal.

Also Read | Ex-WhatsApp Executive Sues Meta Over Alleged Security Failures

Baig raised his concerns repeatedly to WhatsApp leadership, including CEO Mark Zuckerberg, highlighting other issues such as the lack of a comprehensive user data inventory, insufficient monitoring systems, and a failure to detect security breaches. He warned that nearly 100,000 users were being hacked daily, with some estimates rising to 400,000 by 2023, yet Meta prioritised user growth over fixing these vulnerabilities.

Instead of addressing these risks, Baig says he faced escalating retaliation, poor performance reviews, micromanagement, and ultimately termination in April 2025. Meta disputes these allegations, attributing his dismissal to performance issues.

Baig's federal lawsuit alleges that Meta not only ignored his warnings but also falsified security reports and violated whistleblower protections under the Sarbanes-Oxley Act. The suit names Meta, Mark Zuckerberg, and other top WhatsApp executives, accusing them of systemic cybersecurity failures that risk user safety and breach regulatory requirements.

As this high-profile case unfolds, Baig has shed light on what he describes as a culture resistant to scrutiny, where raising security concerns comes at a personal cost.

(With inputs from Bloomberg)