Google says it found security flaw in March but chose not to tell users

Google said on Monday that hundreds of thousands of people who used its Google+ social network may have been affected by a security flaw that the company says it discovered and fixed in March.

The flaw meant some Google+ profile information that users had thought was private, such as a person's email address, occupation, gender or age, could have been viewed by third parties, the company said in a post on a corporate blog.

Though Google found the vulnerability seven months ago, it did not tell the public at the time.

The company said that was because it could not accurately identify which users to inform, whether there was any misuse or whether there were any actions a developer or user could take in response.

The Wall Street Journal reported that Google’s legal and policy staff also prepared a memo warning that disclosing the incident would likely trigger “immediate regulatory interest” and invite comparisons to Facebook’s leak of user information to data firm Cambridge Analytica.

Google declined to comment on the report.

The central issue in the Google+ flaw and in Facebook’s Cambridge Analytica scandal were similar: how third-party apps could gain access to private data about users through their friend networks.

Someone who used their Google+ log-in to play a video game, for example, could have inadvertently allowed the game developer to see private information of their friends such as occupation or gender.

For Subscribers

FOR SUBSCRIBERSCentrist think tank warns 2028 Democrats against swinging too far left on immigration

FOR SUBSCRIBERSRussia’s secrecy after a mysterious plague lab death raises global alarm

FOR SUBSCRIBERSAfter surviving a botched lethal injection, Christa Pike faces unprecedented legal battle

FOR SUBSCRIBERSHunger in a land of plenty: Major food banks face ‘heartbreaking’ need, NBC News survey finds

FOR SUBSCRIBERSInflation and tariffs push U.S. holiday spending projections to a record $1.7 trillion

FOR SUBSCRIBERSWhat happened inside the room where officials tried to execute Christa Pike by lethal injection

FOR SUBSCRIBERSHow we reported the saga of the CIA officer and his gold-bar stash

FOR SUBSCRIBERSBrad Raffensperger gears up to oversee his final election in Georgia

FOR SUBSCRIBERSDiddy is punished following NBC News report on his VIP life in prison and contraband cellphone use

FOR SUBSCRIBERS‘Too young to vote, old enough to be tear gassed’: French protesters’ anger swells

FOR SUBSCRIBERSDOJ gets aggressive in suing states that challenge Trump’s immigration policies

FOR SUBSCRIBERSJustice Department seeks criminal charge for former Trump aide Cassidy Hutchinson

FOR SUBSCRIBERS‘I just want to hold him’: USS Lincoln sailor to meet his 10-month-old son as ship docks

FOR SUBSCRIBERSSenate candidates run on raising Social Security taxes for higher incomes to prevent benefit cuts

FOR SUBSCRIBERSRussian operation that used ChatGPT tricked schools, a politician and media, OpenAI says

Slide 1 of 1

For Subscribers

FOR SUBSCRIBERSCentrist think tank warns 2028 Democrats against swinging too far left on immigration

FOR SUBSCRIBERSRussia’s secrecy after a mysterious plague lab death raises global alarm

FOR SUBSCRIBERSAfter surviving a botched lethal injection, Christa Pike faces unprecedented legal battle

FOR SUBSCRIBERSHunger in a land of plenty: Major food banks face ‘heartbreaking’ need, NBC News survey finds

FOR SUBSCRIBERSInflation and tariffs push U.S. holiday spending projections to a record $1.7 trillion

FOR SUBSCRIBERSWhat happened inside the room where officials tried to execute Christa Pike by lethal injection

FOR SUBSCRIBERSHow we reported the saga of the CIA officer and his gold-bar stash

FOR SUBSCRIBERSBrad Raffensperger gears up to oversee his final election in Georgia

FOR SUBSCRIBERSDiddy is punished following NBC News report on his VIP life in prison and contraband cellphone use

FOR SUBSCRIBERS‘Too young to vote, old enough to be tear gassed’: French protesters’ anger swells

FOR SUBSCRIBERSDOJ gets aggressive in suing states that challenge Trump’s immigration policies

FOR SUBSCRIBERSJustice Department seeks criminal charge for former Trump aide Cassidy Hutchinson

FOR SUBSCRIBERS‘I just want to hold him’: USS Lincoln sailor to meet his 10-month-old son as ship docks

FOR SUBSCRIBERSSenate candidates run on raising Social Security taxes for higher incomes to prevent benefit cuts

FOR SUBSCRIBERSRussian operation that used ChatGPT tricked schools, a politician and media, OpenAI says

Slide 1 of 1

So far, Google said it has found no evidence that profile data was misused or that any developer was aware of the flaw. Facebook has said that up to 87 million people had their data harvested by Cambridge Analytica.

The security flaw will mean the end of Google+ for consumers, the company said. Google launched the service in 2011 as a challenge to Facebook but noted in its blog post on Monday that Google+ “has not achieved broad consumer or developer adoption.”

“The consumer version of Google+ currently has low usage and engagement: 90 percent of Google+ user sessions are less than five seconds,” the company said.

Low usage combined with the security challenges mean Google will wind down Google+ over the next 10 months, although it will continue to provide the service to businesses.

Google said it launched an effort at the beginning of the year called Project Strobe designed to review how other apps connect to Google’s services, and that it was making other changes as a result. It said it would add “more granular” screens for granting permission to access data, and was adding new limits to the data that third-party apps can use.