A former senior security executive at WhatsApp has filed a federal lawsuit against parent company Meta. The lawsuit alleges systematic violations of US cybersecurity regulations and retaliation after he raised internal alarms.
The complaint, filed in federal court in San Francisco, comes from Attaullah Baig, who worked at WhatsApp from 2021 until his termination in February 2025. Baig claims that Meta allowed roughly 1,500 engineers unrestricted access to sensitive WhatsApp user data, including contact information, IP addresses, and profile photos, without oversight or audit mechanisms. He argues that these practices violated a 2020 US government consent order that imposed a $5 billion penalty on Meta following the Cambridge Analytica scandal.
According to the 115-page filing, Baig’s internal security tests revealed that engineers could “move or steal user data without detection,” and that Meta blocked security upgrades intended to reduce widespread account takeovers affecting more than 1,00,000 users daily. He alleges that senior executives, including Will Cathcart, chief, WhatsApp and Mark Zuckerberg, CEO, Meta, were repeatedly informed but failed to act.
Baig claims he faced retaliation after voicing his concerns, receiving poor performance reviews, warnings, and ultimately dismissal. His lawsuit seeks reinstatement, back pay and compensatory damages, along with regulatory action against Meta.
Meta has rejected the allegations, calling Baig’s claims false and describing him as a lower-level engineer dismissed for poor performance. The company cited independent reviews by senior engineers and noted that the US Occupational Safety and Health Administration had already dismissed Baig’s earlier retaliation complaint.
The case adds to mounting scrutiny of Meta’s privacy practices. The 2020 government order remains binding until 2040, and fresh litigation could expose Meta to renewed regulatory penalties if violations are proven.
