At least two U.S. states and two European Union member states are investigating a breach at Google that may have exposed private profile data of at least 500,000 users to hundreds of external developers.
The investigations follow Google’s announcement on Oct. 8 that it would shut down the consumer version of its social network Google+ and tighten its data-sharing policies after a “bug” potentially exposed user data that included names, email addresses, occupations, genders, and ages.
“We are aware of public reporting on this matter and are currently undertaking efforts to gain an understanding of the nature and cause of the intrusion, whether sensitive information was exposed, and what steps are being taken or called for to prevent similar intrusions in the future,” Jaclyn Severance, a spokeswoman for Connecticut Attorney General George Jepsen, said.
The New York Attorney General’s office also said it was looking into the breach.
Google said the issue was discovered and patched in March as part of a review of how Google shares data with other applications. No developer exploited the vulnerability or misused data, the company’s review found.
The Wall Street Journal reported on Monday that Google opted not to disclose the security issue due to fears of regulatory scrutiny, citing unidentified sources and a memo prepared by Google’s legal and policy staff for senior executives.
On Tuesday, Ireland’s data protection regulator said it would seek more information from Google regarding the breach.
“The Data Protection Commission was not aware of this issue and we now need to better understand the details of the breach, including the nature, impact and risk to individuals and we will be seeking information on these issues from Google,” it said.
In Germany, the data protection regulator in Hamburg, the city-state where Google has its country office, is also examining the incident.
It was doing so because the incident occurred before a EU-wide data privacy law took effect in May, creating a “one-stop shop” oversight regime under which Ireland became the lead regulator for Google.
“We have sent a series of questions to Google,” said spokesman Martin Schemm. The Hamburg regulator wants to find out to what extent German users of Google+ were affected, he added. Under Germany’s old data protection law, Google would face a maximum fine of 300,000 euros ($345,000).
Under the EU’s General Data Protection Regulation (GDPR), which took effect on May 25, maximum fines run to 4 percent of a company’s annual global turnover, meaning that penalties against the biggest Silicon Valley players could in theory run into billions of dollars.
Google did not immediately respond to a Reuters request for comment.
By Angela Moon and Arjun Panchadar
