Attaullah Baig, an Indian-origin cybersecurity professional who was the head of security for WhatsApp from 2021 to 2025, has filed a federal lawsuit against Meta. According to the lawsuit filed in the US District Court for the Northern District of California, Baig alleged that his warnings about “systemic cybersecurity failures” were ignored. In addition, when he raised the matter further, it cost him his job.
Who is Attaullah Baig?
Attaullah Baig is an Indian-origin cybersecurity expert with more than two decades of experience. A graduate of NIT Warangal with a degree in Computer Science, he later completed a Master’s in Computer Science from the University of Utah. As WhatsApp’s head of security, Attaullah Baig was responsible for protecting user data.
His legal team, including the whistleblower group Psst.org, claimed that his firing was a direct result of his efforts to raise privacy concerns within the company.
Complaint filed and allegations
According to the complaint filed, during a routine security test, Biag discovered that nearly 1,500 WhatsApp engineers have unrestricted access to the user’s data, including sensitive personal information. He alleged that this allowed engineers to move the data without being detected; however, no such incident of data theft was reported. The complaint highlighted that this is a potential violation of federal law and a 2020 privacy settlement Meta reached with the US Federal Trade Commission.
The complaint further alleged that after the initial disclosure by Baig, he received poor performance reviews. He named this the campaign of retaliation for raising his voice against data security concerns. He also filed complaints with the US Securities and Exchange Commission (SEC) and the Occupational Safety and Health Administration (OSHA), against both retaliation and compliance failures.
What does Meta say?
Meta has denounced Baig’s claims. A company spokesperson told CNBC that, “Sadly this is a familiar playbook in which a former employee is dismissed for poor performance and then goes public with distorted claims that misrepresent the ongoing hard work of our team. Security is an adversarial space, and we pride ourselves in building on our strong record of protecting people’s privacy.”