How did ‘The Great Hack’ expose Facebook’s data breach?

The Great Hack returns to the front of people’s minds whenever a new privacy case lands on a courtroom docket. The 2019 Netflix documentary walks through the Cambridge Analytica scandal in real time, showing how a personality quiz quietly pulled data from up to 87 million Facebook accounts and turned it into voter profiles. That single breach still shapes lawsuits, platform rules, and public trust in how personal information moves through elections.

Timeline of the data grab

Cambridge University researcher Aleksandr Kogan built the app thisisyourdigitallife in 2014. Roughly 270,000 people installed it, and Facebook’s then-open policies let the code collect friend lists without extra consent. Within weeks the dataset ballooned to tens of millions of profiles, each tagged with likes, locations, and private messages.

Cambridge Analytica licensed the data through Kogan’s shell company and began building personality scores for every American voter. Early tests focused on Ted Cruz’s 2016 primary run, where the firm claimed it could identify likely supporters down to the block level. The same models later moved to the Trump general campaign and the Brexit Leave effort.

Facebook suspended the app only after The Guardian published the first reports in December 2015. By then the data had already traveled through multiple subcontractors and remained on servers in several countries. Internal e-mails later showed the company treated the breach as a public-relations problem rather than a security failure.

Key figures on screen

Director duo Karim Amer and Jehane Noujaim follow three main characters. Parsons professor David Carroll sues to recover his own file, turning a single data request into a test case for digital rights. Former Cambridge Analytica employee Brittany Kaiser hands over internal documents after growing uneasy with the firm’s election work. Guardian reporter Carole Cadwalladr pieces together the paper trail that finally forces Facebook to admit the scale of the leak.

Each storyline gives viewers a different window into the same machine. Carroll’s legal fight highlights how difficult it is for any individual to learn what a platform knows. Kaiser’s testimony shows how quickly campaign consultants accepted the data as just another targeting tool. Cadwalladr’s scoops prove that traditional reporting still drives accountability when companies stay silent.

The directors let the subjects speak without narration-heavy exposition. Viewers watch raw footage of Cambridge Analytica CEO Alexander Nix boasting about “5,000 data points on every American voter,” then cut to the quiet aftermath of bankruptcy filings and congressional hearings.

How the breach actually worked

The technical exploit was simple. Facebook’s Open Graph allowed any app to request a user’s friend graph once that user granted basic access. Kogan’s quiz asked for little more than a name and e-mail, then pulled birthdays, hometowns, and relationship statuses from entire networks. No password theft or malware was needed.

Cambridge Analytica combined the raw Facebook fields with consumer and voter files already available for purchase. The result was a composite profile that scored individuals on openness, conscientiousness, and neuroticism. Campaigns used these scores to decide which message, image, or video each user would see next.

The Great Hack illustrates the process with side-by-side screens: a Facebook post on one side, the matching psychographic tag on the other. The sequence makes clear that the breach was less about stolen passwords and more about policy loopholes that treated friendships as public data.

Impact on the 2016 vote

Cambridge Analytica’s models reached voters in key swing states during the final weeks of the 2016 campaign. Internal slides shown in the film list microtargeted ads aimed at infrequent voters who scored high on specific personality traits. The firm argued that small shifts among these groups could decide close races.

Independent researchers have since debated the exact margin of influence. What remains undisputed is that Facebook allowed a third party to build detailed political dossiers on tens of millions of users and sell access to those dossiers to campaigns. That precedent still colors every discussion about platform responsibility during elections.

The documentary avoids claiming the data alone flipped the outcome. Instead it shows how easily the infrastructure for manipulation was assembled and how little oversight existed once the data left Facebook’s servers.

Regulatory and corporate fallout

After the March 2018 stories broke, Facebook’s market value dropped roughly $100 billion in days. The Federal Trade Commission later levied a record $5 billion fine, the largest ever against a tech company for privacy violations. Cambridge Analytica and its parent SCL Elections filed for bankruptcy within months.

Mark Zuckerberg testified before Congress that the company had been “too slow” to spot the misuse. New policies restricted third-party data access, yet critics noted the changes arrived only after the data had already circulated. The Great Hack captures Zuckerberg’s congressional appearance as a turning point that still left users without clear remedies.

Seven years later, the same underlying questions surface in court. A 2026 trial in New Mexico found that Meta misled consumers about privacy controls, resulting in a jury verdict and the possibility of additional fines. The case echoes the original breach without involving Cambridge Analytica at all.

Personal data as commodity

David Carroll’s on-screen refrain that “data rights are human rights” lands differently now that most people manage their lives through a handful of apps. The film shows how easily a quiz about movie tastes can become leverage in a national election, turning everyday clicks into political weapons.

Carroll’s lawsuit seeks only the file Cambridge Analytica compiled on him, yet the request exposes how few users ever see the downstream products built from their data. The case remains unresolved in several jurisdictions, keeping the documentary’s questions alive in real dockets.

Viewers leave the film with a practical takeaway: every free personality test or game carries the same risk that once allowed 87 million profiles to move without notice. The Great Hack simply documents how that risk became reality.

Media and cultural ripple effects

The documentary arrived on Netflix in July 2019 and quickly became a reference point in privacy debates. Newsrooms began using its footage in explainers, while university courses adopted it to illustrate the supply chain from app store to campaign server.

Social-media clips of Nix’s undercover boasts resurfaced during later hearings on election integrity. The film’s visual style, built around laptop screens and redacted documents, influenced later investigative series that treat data as a character in its own right.

Public conversation has since shifted from “how did this happen” to “why hasn’t it been fixed.” The Great Hack serves as shorthand for that unfinished argument whenever a new leak or policy rollback appears in headlines.

Why the story still resonates

Elections continue to rely on the same platforms and data brokers that once supplied Cambridge Analytica. Recent platform changes have narrowed some pathways, yet political advertisers still purchase detailed voter segments built on similar foundations.

Users who watched the film in 2019 now face daily decisions about what to share, and the stakes remain the same. The Great Hack keeps the original breach visible so that each new disclosure can be measured against a documented precedent.

The documentary ends without a tidy resolution because none exists. Instead it leaves the mechanics on the table for viewers to judge the next time a quiz promises insight in exchange for access.

Looking ahead

Courts, regulators, and platforms are still negotiating the limits exposed by the Cambridge Analytica episode. The Great Hack supplies the clearest public record of how those limits were first tested and breached. Its continued relevance lies in the simple fact that the data pipelines it mapped have not disappeared; they have only changed owners and labels.