Google has announced its plan on Monday to shut down Google Plus, it social media platform, after it discovered a security vulnerability that exposed the private data of up to 500,000 users of the service.
Google did not tell its users about the security issue when it was found in March because it didn’t appear that anyone had gained access to user information, and the company’s “Privacy & Data Protection Office” decided it was not legally required to report it.
The search engine giant looked at the “type of data involved, whether we could accurately identify the users to inform, whether there was any evidence of misuse, and whether there were any actions a developer or user could take in response.
Up to 438 applications made by other companies may have had access to the vulnerability through coding links called application programming interfaces. Those outside developers could have seen user names, email addresses, occupation, gender and age. They did not have access to phone numbers, messages, Google Plus posts or data from other Google accounts, the company said.
The incident could face additional scrutiny because of a memo to senior executives reportedly prepared by Google’s policy and legal teams that warned of embarrassment for Google similar to what happened to Facebook earlier this year if it went public with the vulnerability.
The decision to shut down Google Plus was part of a broad review of how much user information Google shares with third-party developers. Google, a unit of Alphabet, also said it is limiting the apps that can work with Gmail, the company’s email service, and constraining the amount of data that developers can access through Android, Google’s smartphone software.
Google looked at the “type of data involved, whether we could accurately identify the users to inform, whether there was any evidence of misuse, and whether there were any actions a developer or user could take in response. None of these thresholds were met in this instance,”.