Facebook employees were able to read millions of user passwords for years, the company said on Thursday after a security researcher posted about the issue online.
"Security 101 dictates that under no circumstances should passwords be stored in plain text and at all times must be encrypted," said cyber-security expert Andrei Barysevich, of Recorded Future.
"There is no valid reason why anyone in an organisation, especially the size of Facebook, needs to have access to users' passwords in plain text."
Facebook said there was no evidence that its employees abused access to the data, but thousands of staff could have searched for them.
The company said the passwords were stored on internal company servers, where no outsiders could access them.
But the incident reveals a huge mistake by the company amid many the past couple of years.
The security blog KrebsOnSecurity said about 600 million Facebook users may have had their passwords stored in plain text.
Facebook said in a blog post on Thursday that it would probably notify "hundreds of millions" of Facebook Lite, millions of Facebook and tens of thousands of Instagram users that their passwords were stored in plain text.
Facebook Lite is designed for users with older phones or low-speed internet connections, and is mainly used in developing countries.
Facebook said it discovered the problem in January. But security researcher Brian Krebs said that in some cases, the passwords had been stored in plain text since 2012.
Facebook Lite was launched in 2015 and Facebook bought Instagram in 2012.
Mr Barysevich said he could not recall any major company gaving been caught leaving so many passwords exposed.
He said that he had seen instances where much smaller organisations made the information readily available to programmers and customer support teams.
