Ousted WhatsApp Security Head Sues Meta After Whistleblowing

The former head of security at WhatsApp alleges Meta Platforms Inc. fired him in February because of whistleblowing and escalating privacy and cybersecurity concerns up to its CEO.

Attaullah Baig was fired less than two months after telling CEO Mark Zuckerberg he’d tipped off the Securities and Exchange Commission and one month after informing Meta he’d filed a retaliation complaint with the Department of Labor’s Occupational Safety and Health Administration, according to his lawsuit filed Monday in the US District Court for the Northern District of California.

Baig said he was let go under the guise of “poor performance,” but the real reason was allegedly the culmination of years of alleged threats from bosses over his reporting. He flagged compliance failures and cybersecurity issues that gave 1,500 WhatsApp engineers “unrestricted access to user data” and allowed account takeovers affecting 100,000 users “daily.”

The whistleblower said he’d first “discovered systemic cybersecurity failures” in 2021, shortly after joining WhatsApp as head of security. That included the flouting of federal securities laws and a Federal Trade Commission order which required then-Facebook to pay a $5 billion civil penalty and heighten privacy protections. Baig also saw what he thought were several Sarbanes Oxley Act violations.

An attorney for Baig at nonprofit Psst.org, Jennifer Gibson, said she couldn’t think of another company with as many whistleblowers as Meta.

“Meta had a choice: They could fix the problems or attack the messenger, and they chose the latter,” she said.

Zuckerberg Letters

In January 2024, Baig sent Zuckerberg, who is listed as a defendant along with Meta, and Meta’s general counsel a letter documenting alleged 2020 FTC order and SEC rules violations. He pleaded “that the central security team had falsified security reports to cover up decisions not to remediate data exfiltration risks” and that such falsifications could lead to criminal penalties.

Meta purportedly blocked features he and his team built to mitigate user harm. Come November 2024, Baig filed an SEC form “documenting Meta’s cybersecurity deficiencies and failure to inform investors about material cybersecurity risks.” He allegedly sent Zuckerberg another letter that December, disclosing the alleged continuation of cybersecurity issues, escalated retaliation, and the form’s filing.

“Sadly this is a familiar playbook in which a former employee is dismissed for poor performance and then goes public with distorted claims that misrepresent the ongoing hard work of our team,” Carl Woog, VP of Global Communications at WhatsApp, said in an email.

Baig wants reinstatement with the same seniority status that he’d have had barring discrimination, back pay, and compensation for special damages and “for emotional distress, mental anguish, and other consequential damages.”

Schonbrun Seplow Harris Hoffman & Zeldes LLP also represents Baig.

The case is Baig v. Meta Platforms, Inc., N.D. Cal., No. 3:25-cv-07604, complaint filed 9/8/25.