Google reveals potential Google+ security bug first discovered in March

Google said it discovered a bug in March. (JOHANNES EISELE /AFP/Getty Images)

Google has quietly announced that up to 500,000 Google+ accounts may have been compromised thanks to a bug in one of its programming tools that the company first discovered seven months ago.

The tech company revealed the hacked profiles Monday in a statement, and said the glitch was discovered in March amid a review of just how much access third-party developers have to accounts called Project Strobe.

Information potentially accessed by the outside developers from 2015 until the fix was limited to name, email address, occupation, gender and age.

The Wall Street Journal reports that the company sat on the bug for months for fear of drawing regulatory scrutiny and “reputational damage” similar to Facebook’s public relations disaster after user information was leaked to Cambridge Analytica.

An internal memo from legal and policy staff reportedly said the company found no evidence that the data had been misused, but was unable to know for certain.

It was a bug in the API that led to the glitch; outside developers were able to collect profile data despite privacy settings meant to ensure the information wasn’t public. The company said that up to 438 apps may have used the API.

Google also said it’ll wind down the use of the consumer version of Google+, and will bid it farewell for good by August.

The company said it’ll focus its energy on using Google+ as an enterprise product within companies.

In light of the data breach, Google said consumers will “get more fine-grained control” over what data they choose to share, and that they will limit the number of apps that can gain access to consumers’ Gmail data.