2018 Google data breach

In June 2011, Google+ was launched as an invite-only social network[9] and then become a public database later in that year. Google+ was managed by Vic Gundotra, Google's senior vice president of engineering.[10] Similar to Facebook, Google+ acted as a social media database for posting photos and creating status's on individual feeds yet included the key features including Circles, Hangouts and Sparks.

Circles were created to allow consumers to personalise their social groups by sorting friends into different categories. Once allowed into a Circle, the person can be allowed to see particular content and be restricted from others.[11] Therefore, users can regulate access of information in their individual spaces. Hangouts included video chatting and instant messaging between consumers.[12] The other key feature of Google+ was Sparks; where Google tracked your past searches using keywords to find news and content related to a user's interests.[13]

Along with being a social network, Google+ was produced to be the social layer of Google and its many apps and hence was used within other Google Profiles such as YouTube, Gmail and others. Google+ had over 2 billion user accounts within its interface[14] as it gave access to many Google apps including Gmail and Google Drive. However, less than 400 million consumers were actively using the social media aspect, with 90% of these users using the social network for five seconds.[15] Hence, Google+ did not have a large amount of consumer interaction within the social media network.

Along with the data breaches, Google+ saw limited consumer interaction with apps and low social media usage and so, the social network was shut down[16] on 2 April 2019.

In January 2018, a formal assessment of third-party developers and app access to Google accounts was created named Project Strobe.[17] Through this project, privacy platforms were examined and tightened as consumers were concerned of data privacy. Google Project Strobe constructs a review on consumer's profiles, identifying what parts of a profile third-party developers are able to access. Many third-party apps use Google+ as a service to improve communication, working life and online experience. In March, the analysis of Application Programming Interfaces (API) showed a data breach within the Google+ People API where external apps acquired access to Profile fields that were not marked as public.[4]

Google found that there was no evidence of any user's personal information being misused. A detailed analysis identified that 500,000 Google+ accounts were included in this data breach which was capable of allowing 438 external apps without authorisation to private users names, emails, addresses, occupations, gender and age.[4] This information was able to be accessed by third-party apps between 2015 and 2018.[18] There was no evidence found that any of this information was misused, and Google is not able to confirm which particular users profile data was accessible or impacted. There was no evidence found that any third-party app developers were aware of this profile leakage and abused this.

In November 2018, a software update created another data breach within the Google+ API. The bug impacted 52.5 million users[19] where, similarly to the past data breach, apps were able to access Google+ profiles without consent displaying name, email address, occupation and age. Apps were not able to access information relating to financial, national identification numbers or passwords. Google+ blog posts, messages and phone numbers also remained inaccessible if displayed as private information. Dissimilar to the last data breach, access was granted for six days before Google+ gained knowledge of the data leakage and was able to rectify the problem. Google+ found no evidence of misused data by third-party developers and consumers were Access was granted for six days before Google+ was able to rectify the problem, however they found no evidence of misuse and an announcement of the leakage was made to Google+ consumers.

The publishing of ‘Google Exposed User Data, Feared Repercussions of Disclosing to Public’ by the Wall Street Journal on October 8, 2018 outlined the initial data breach, describing how Google+ had not originally disclosed the issue. They advised the public that the data breach had occurred between 2015 and 2018 through a leakage in the API software where third-party apps were able to access private information. There is no federal law that requires Google to inform their consumers of data breaches. Google+ originally did not want to disclose the information in fear of comparison to Facebook's data leakage and loss of consumer confidence.[5] In response to the article, Google announced the permanent shut down of all consumer functionality in August 2019. After the second data leakage this date was accelerated and moved to April 2019.

Alongside the Wall Street Journal, considerable amounts of coverage was made on each data breach by newspapers around the world discussing consumer's privacy levels. On 8 October 2018, a Google Blog post described the first data leakage and the shutdown of Google+, written by Ben Smith, the Vice President of Engineering within Google.[17] Following the second data breach, Google Blog posted an article written by the Vice President of Product Management, David Thacker, on December 10, 2018.[2] This article indicated that Google+ APIs would be shutting down within the next 90 days and the acceleration of the closing of Google+. Both articles provide a detailed explanation of each data breach, the ramifications for Google+ and ensured consumers on the privacy and reliance on Google of consumer data.

In response to the data breach, enterprise consumers were notified of the impact of the bug and given instructions on how to save, download and delete their data prior to the Google+ shut down. The issues were analysed by Google's Privacy and Data Protection Office, finding that there was no misuse of consumer's profiles data. However, Google decided that Google+ was not being used in abundance as a social media network and hence the network should be shut down.