2018 Google data breach

Short description: 2018 data breach affecting the social network Google+

Vic Gundotra, Google+ lead at the time of the leaks.

The 2018 Google data breach was a major data privacy scandal in which the Google+ API exposed the private data of over five hundred thousand users.[1]

Google+ managers first noticed harvesting of personal data in March 2018,[2] during a review following the Facebook–Cambridge Analytica data scandal. The bug, despite having been fixed immediately, exposed the private data of approximately 500,000 Google+ users to the public.[3] Google did not reveal the leak to the network's users.[4] In November 2018, another data breach occurred following an update to the Google+ API. Although Google found no evidence of failure, approximately 52.5 million personal profiles were potentially exposed.[5] In August 2019, Google declared a shutdown of Google+ due to low use and technological challenges.[6][7][8]

## Contents

* 1 Overview of Google+
* 2 The breaches
* 3 Responses
* 4 References

## Overview of Google+

Google+ was launched in June 2011 as an invite-only social network,[9] but was opened for public access later in the year. It was managed by Vic Gundotra.[10]

Similar to Facebook, Google+ also included key features Circles, Hangouts and Sparks.

* Circles let users personalize their social groups by sorting friends into different categories. Once allowed into a Circle, users could regulate information in their individual spaces.[11]
* Hangouts included video chatting and instant messaging between users.[12]
* Sparks allowed Google to track users' past searches to find news and content related to their interests.[13]

Google+ was linked to other Google services, such as YouTube, Google Drive and Gmail, giving it access to roughly 2 billion user accounts.[14] However, less than 400 million consumers actively used Google+, with 90% of those users using it for less than five seconds.[15]

## The breaches

In March 2018, Google developers found a data breach within the Google+ People API in which external apps acquired access to Profile fields that were not marked as public.[3] According to The Wall Street Journal, Google didn’t disclose the breach when it was first discovered in March to avoid regulatory scrutiny and reputational damage.[4]

500,000 Google+ accounts were included in the breach, which allowed 438 external apps unauthorized access to private users' names, emails, addresses, occupations, genders and ages.[3] This information was available between 2015 and 2018.[16] Google found no evidence of any user's personal information being misused, nor that any third-party app developers were aware of the leak.

In November 2018, a software update created another data breach within the Google+ API.[17] The bug impacted 52.5 million users,[18][2] where, similarly to the March breach, unauthorized apps were able to access Google+ profiles, including users' names, email addresses, occupations and ages. Apps could not access financial information, national identification, numbers, or passwords. Blog posts, messages and phone numbers also remained inaccessible if marked as private. Unlike the previous breach, access was only available for six days before Google+ learned of the breach. Once more, Google+ found no evidence of data being misused by third-party developers.

## Responses

In October 2018, the Wall Street Journal published an article outlining the initial breach and Google's decision to not disclose it to users.[4] At the time, there was no federal law that required Google to inform their consumers of data breaches. Google+ originally did not disclose the breach out of fears of being compared to Facebook's recent data leak and subsequent loss of consumer confidence.[4] In response to the Wall Street Journal article, Google announced the shutdown of Google+ in August 2019.[19] After the second data leak, the date was moved to April 2019.[20] In response to the data breach, enterprise consumers were notified of the bug's impact and given instructions on how to save, download and delete their data prior to the Google+ shut down. Google's Privacy and Data Protection Office found no misuse of user data.

Prior to the Google+ shutdown, Google set a 10-month period in which users could download and migrate their data. After the 10-month period, user content was deleted. On 4 February 2019, consumers were no longer able to create new Google+ profiles.[21] Google shut down Google+ APIs on 7 March 2019 to ensure that developers did not continue to rely on the APIs prior to the Google+ shutdown.[7][16]

Google is the principal entity of its parent company, Alphabet Inc. After the data breach, Alphabet Inc. share prices fell by 1% to $1,157.06 on 9 October 2018 after an earlier drop of $1,135.40 that morning, the lowest price since 5 July 2018.[22] After the publication of The Wall Street Journal article, share prices dropped as low as 2.1% in two days on 10 October 2018. Share prices steadily increased from this point and met the 8 October 2018 share price on 5 February 2019.[23]

Google planned to rebuild Google+ as a corporate enterprise network.[24] Google Play will now assess which apps can ask for permission to access the user's SMS data. Only the default app for telephone distribution is able to make requests. Prior to the data breaches, apps were able to request access to all of a consumer's data simultaneously. Now, each app must request permission for each aspect of a consumer's profile.

## References

1. ↑ Snider, Mike (1 February 2019). "Google sets April 2 closing date for Google+, download your photos and content before then". https://www.usatoday.com/story/tech/talkingtech/2019/02/01/google-close-google-social-network-april-2/2741657002/.
2. ↑ 2.0 2.1 Newman, Lily Hay (12 October 2018). "A New Google+ Blunder Exposed Data From 52.5 Million Users". Wired. ISSN 1059-1028. https://www.wired.com/story/google-plus-bug-52-million-users-data-exposed/. Retrieved 12 May 2019.
3. ↑ 3.0 3.1 3.2 "Flaw leads to Google+ shutting down". Network Security 2018 (10): 3. 2018. doi:10.1016/S1353-4858(18)30095-3.
4. ↑ 4.0 4.1 4.2 4.3 MacMillan, Douglas; McMillan, Robert (8 October 2018). "Google Exposed User Data, Feared Repercussions of Disclosing to Public". Wall Street Journal. ISSN 0099-9660. https://www.wsj.com/articles/google-exposed-user-data-feared-repercussions-of-disclosing-to-public-1539017194.
5. ↑ Romm, Tony; Timberg, Craig (10 December 2018). "New Google+ security bug could affect more than 52 million users". The Washington Post. https://www.washingtonpost.com/technology/2018/12/10/google-reveals-new-security-bug-affecting-more-than-million-users/.
6. ↑ Thacker, David (10 December 2018). "Expediting changes to Google+". https://www.blog.google/technology/safety-security/expediting-changes-google-plus/.
7. ↑ 7.0 7.1 "Google+ API Shutdown | Google+ Platform". https://developers.google.com/+/api-shutdown.
8. ↑ "Google's social network is closing". New Scientist 240 (3199): 4. 2018. doi:10.1016/S0262-4079(18)31819-0.
9. ↑ Fox, Chris (2 April 2019). "Google shuts failed social network Google+". BBC News. https://www.bbc.com/news/technology-47771927.
10. ↑ Dieter, Daniel (11 November 2018). "Google+ Case Study: Create a Social Network or Risk Everything". Performance Improvement 57 (10): 26–36. doi:10.1002/pfi.21826.
11. ↑ Ovadia, Steven (5 December 2011). "An Early Introduction to the Google+ Social Networking Project". Behavioral & Social Sciences Librarian 30 (4): 259–263. doi:10.1080/01639269.2011.622258. https://academicworks.cuny.edu/cgi/viewcontent.cgi?article=1016&context=lg_pubs.
12. ↑ Golbeck, Jennifer (2015). "Google+". Introduction to Social Media Investigation. pp. 137–149. doi:10.1016/B978-0-12-801656-5.00013-5. ISBN 9780128016565.
13. ↑ Perez, Sarah (November 2018). "Looking back at Google+". https://techcrunch.com/2018/10/08/looking-back-at-google/.
14. ↑ "Google+ social media service to shut down after private data of at least 500,000 users exposed". ABC News. 9 October 2018. https://www.abc.net.au/news/2018-10-09/google-social-media-service-shut-down-after-privacy-issue/10354918.
15. ↑ Ganjoo, Shweta. "Former Google+ designer explains why Google's social media play failed: it was mostly office politics". https://www.indiatoday.in/technology/features/story/former-google-designer-explains-why-google-s-social-media-play-failed-1370662-2018-10-18.
16. ↑ 16.0 16.1 Burton, Winston (25 October 2018). "Google Plus: Past, Present & Future". Search Engine Journal.
17. ↑ "Second Google+ data exposure leads to earlier service shutdown | TechTarget" (in en). https://www.techtarget.com/searchsecurity/news/252454254/Second-Google-data-exposure-leads-to-earlier-service-shutdown.
18. ↑ "Expediting changes to Google+". 10 December 2018. https://www.blog.google/technology/safety-security/expediting-changes-google-plus/.
19. ↑ Smith, Ben (8 October 2018). "Project Strobe: Protecting your data, improving our third-party APIs, and sunsetting consumer Google+". https://www.blog.google/technology/safety-security/project-strobe/.
20. ↑ "Frequently asked questions about the Google+ shutdown - Google+ Help". https://support.google.com/plus/answer/9217723#whatshappening.
21. ↑ Nelson, Alex (7 February 2019). "Google+ shutdown: how to back up photos and data before your account closes". https://inews.co.uk/news/technology/google-plus-shutdown-back-up-data/.
22. ↑ De Vynck, Gerrit; Nix, Naomi (9 October 2018). "Google Discloses Privacy Security Flaw Kept Quiet Since March". https://www.bloomberg.com/news/articles/2018-10-08/google-falls-after-report-it-covered-up-potential-security-flaw.
23. ↑ Aitken, Roger. "Alphabet 'In The Soup' Over Costs, But Analysts' Average Google Price Target $1,346". https://www.forbes.com/sites/rogeraitken/2019/02/05/alphabet-in-the-soup-over-costs-but-analysts-average-google-price-target-1346/#1b77fefc3124.
24. ↑ "Currents: Have Meaningful Discussions at Work | G Suite". https://gsuite.google.com/products/currents/.

* v
* t
* e

Google

* Alphabet Inc.
* Android
* Devices
* Nexus
* Pixel
* Maps
* YouTube

Company|

* Overview
* Alphabet Inc.
* History
* List of mergers and acquisitions by Alphabet
* List of products
* Criticism
* Privacy concerns
* Censorship
* Litigation
* Don't be evil

Real estates|

* 111 Eighth Avenue
* Chelsea Market
* Googleplex
* Data centers

Advertising|

* AdMob
* Adscape
* Ads
* AdSense
* Analytics
* Contributor

Events|

* Code-in
* Code Jam
* Developer Day
* I/O
* Science Fair
* Summer of Code
* Talks at Google

People|

* Al Gore
* Alan Eustace
* Alan Mulally
* Amit Singhal
* Ann Mather
* David Drummond
* Eric Schmidt
* Jeff Dean
* John Doerr
* John L. Hennessy
* Krishna Bharat
* Matt Cutts
* Patrick Pichette
* Paul Otellini
* Omid Kordestani
* Rachel Whetstone
* Rajen Sheth
* Ram Shriram
* Ray Kurzweil
* Ruth Porat
* Salar Kamangar
* Sanjay Ghemawat
* Shirley M. Tilghman
* Sundar Pichai
* Susan Wojcicki
* Urs Hölzle
* Vint Cerf
* Hal Varian

Terms|

* Gayglers
* Google Developer Expert

Founders|

* Larry Page
* Sergey Brin

Typefaces|

* Noto
* Roboto
* Product Sans

Products|

| Software|

* Assistant
* Camera
* Lens
* Goggles
* Chrome
* for Android
* Web Store
* Chromium
* Cloud Print
* Earth
* Gadgets
* Gboard
* IME
* Japanese
* Pinyin
* Pay
* Pay Send
* Photos
* Keep
* News
* Now
* OpenRefine
* Snapseed
* Waze

Operating systems|

* Android
* version history
* software development
* Android Automotive
* Android TV
* Wear OS
* List of devices
* Chrome OS
* Apps
* Fuchsia

Programming languages|

* Dart
* Go
* Sawzall

Frameworks|

* Angular
* AngularJS
* AJAX APIs
* Dialogflow
* Flutter
* Guava
* Guice
* TensorFlow

Communication|

* Alerts
* Apps Script
* Duo
* Calendar
* Contacts
* Gmail
* history
* interface
* Groups
* Hangouts
* Chat
* Meet
* Sync
* Text-to-Speech
* Translate
* Transliteration
* Voice

Platforms|

* Account
* Authenticator
* Android Auto
* ZygoteBody
* Cast
* Cloud Platform
* App Engine
* BigQuery
* Bigtable
* Compute Engine
* Storage
* Fit
* GFS
* G Suite
* Classroom
* Marketplace
* Native Client
* OpenSocial
* Pay
* Send
* Primer
* Play
* Books
* Games
* Movies & TV
* Music
* Public DNS
* Safe Browsing
* Stadia
* Tango
* YouTube TV

Development|

* App Inventor
* Caja
* Closure Tools
* Developers
* Firebase
* GData
* KML
* Kythe
* MapReduce
* Owlchemy Labs
* Web Toolkit
* Search Console
* Website Optimizer
* Swiffy

Publishing|

* AMP
* Blogger
* Domains
* Drive
* Docs
* Sheets
* Slides
* Drawings
* Forms
* Fusion Tables
* FeedBurner
* Google Podcasts
* Sites
* YouTube
* Instant
* Premium
* Vevo
* Zagat

Search
(timeline)|

* Blog Search
* Books
* Ngram Viewer
* Custom Search
* Dataset Search
* Dictionary
* Finance
* Flights
* Googlebot
* Images
* Maps
* Street View
* Coverage
* Privacy concerns
* News
* Archive
* Patents
* Public Data
* Scholar
* Shopping
* Tenor
* Videos

Algorithms|

* PageRank
* Panda
* Penguin
* Hummingbird

Features|

* Personalized
* SafeSearch
* Voice Search

Analysis|

* Insights for Search
* Trends
* Knowledge Graph and Vault

Hardware|

* Glass
* Home
* Jamboard
* Wifi
* OnHub

Virtual reality|

* Cardboard
* Daydream

Nest|

* Nest Learning Thermostat
* Nest

Smartphones|

* Nexus
* Pixel

Chrome|

* Chromebit
* Chromecast
* Chromebook
* Chromebox

Other|

* .google
* Arts & Culture
* ATAP
* Chrome Zone
* Data Transfer Project
* Dragonfly
* Current
* Chrome Experiments
* Google Business Groups
* Made with Code
* Data Liberation
* Takeout
* Google (verb)
* Google China
* Google Express
* Googlization
* Google.org
* Logo and related
* Doodle4Google
* Google Doodles
* Lunar X Prize
* Google Fi
* Google Station
* Material Design
* Motorola Mobility
* Nest Labs
* reCAPTCHA
* Sunroof
* WiFi
* AI Challenge
* Easter eggs
* elgooG

Related|

* Google bombing
* Goojje
* Monopoly City Streets
* Unity

Documentaries|

* Google: Behind the Screen
* Google: The Thinking Factory
* Google and the World Brain

* Category
*   *   * Discontinued products and services

* v
* t
* e

Hacking in the 2010s

| <- 2000s | Timeline | 2020s ->

|
|

Major incidents|

| 2010|

* Operation Aurora
* Australian cyberattacks
* Operation ShadowNet
* Operation Payback

|

2011|

* DigiNotar
* DNSChanger
* HBGary Federal
* Operation AntiSec
* Operation Tunisia
* PlayStation
* RSA SecurID compromise

2012|

* LinkedIn hack
* Stratfor email leak
* Operation High Roller

2013|

* South Korea cyberattack
* Snapchat hack
* Cyberterrorism Attack of June 25
* 2013 Yahoo! data breach

2014|

* Anthem medical data breach
* Operation Tovar
* iCloud leaks of celebrity photos
* 2014 JPMorgan Chase data breach
* Sony Pictures hack
* Russian hacker password theft
* 2014 Yahoo! data breach

2015|

* Office of Personnel Management data breach
* Hacking Team
* Ashley Madison data breach
* VTech data breach
* Ukrainian Power Grid Cyberattack
* SWIFT banking hack

2016|

* Bangladesh Bank robbery
* Hollywood Presbyterian Medical Center ransomware incident
* Commission on Elections data breach
* Democratic National Committee cyber attacks
* Vietnam Airport Hacks
* DCCC cyber attacks
* Indian Bank data breaches
* Dyn cyberattack
* Russian interference in the 2016 U.S. elections

2017|

* 2017 Macron e-mail leaks
* WannaCry ransomware attack
* Westminster cyberattack
* Petya cyberattack
* 2017 cyberattacks on Ukraine
* Equifax data breach
* Deloitte breach
* Disqus breach

2018|

* Trustico
* Exactis
* Atlanta cyberattack

2019|

* Sri Lanka cyberattack
* Baltimore ransomware attack
* 2019 Bulgarian revenue agency hack
* Capital One data breach
* Zynga Breach

Groups|

| Hacktivism|

* Anonymous
* associated events
* CyberBerkut
* GNAA
* Goatse Security
* Lizard Squad
* LulzRaft
* LulzSec
* New World Hackers
* NullCrew
* OurMine
* PayPal 14
* RedHack
* TeaMp0isoN
* UGNazi

|

Advanced Persistent Threat|

* Bureau 121
* Carbanak (group)
* Charming Kitten
* Cozy Bear
* Elfin Team
* Equation Group
* Fancy Bear
* FreeMilk
* Guccifer 2.0
* Hacking Team
* Helix Kitten
* Iranian Cyber Army
* Lazarus Group (BlueNorOff) (AndAriel)
* NSO Group
* PLA Unit 61398
* PLA Unit 61486
* PLA Unit 78020
* PLATINUM
* Pranknet
* Red Apollo
* Rocket Kitten
* Syrian Electronic Army
* Tailored Access Operations
* The Shadow Brokers
* Yemen Cyber Army

Individuals|

* DkD[||
* George Hotz
* Guccifer
* Jeremy Hammond
* Junaid Hussain
* Kristoffer von Hassel
* Mustafa Al-Bassam
* MLT
* Ryan Ackroyd
* Sabu
* Topiary
* Track2
* The Jester
* weev

Major vulnerabilities
publicly disclosed|

* Evercookie (2010)
* iSeeYou (2013)
* Heartbleed (2014)
* Shellshock (2014)
* POODLE (2014)
* Rootpipe (2014)
* Row hammer (2014)
* JASBUG (2015)
* Stagefright (2015)
* DROWN (2016)
* Badlock (2016)
* Dirty COW (2016)
* Cloudbleed (2017)
* Broadcom Wi-Fi (2017)
* EternalBlue (2017)
* DoublePulsar (2017)
* Silent Bob is Silent (2017)
* KRACK (2017)
* ROCA vulnerability (2017)
* BlueBorne (2017)
* Meltdown (2018)
* Spectre (2018)
* EFAIL (2018)
* Speculative Store Bypass (2018)
* Lazy FP State Restore (2018)
* TLBleed (2018)
* SigSpoof (2018)
* Foreshadow (2018)
* Fallout (2019)
* RIDL (2019)
* ZombieLoad (2019)
* BlueKeep (2019)

Malware|

| 2010|

* Bad Rabbit
* Stuxnet

|

2011|

* Kelihos
* Stars
* Metulji botnet
* Duqu
* Alureon

2012|

* Mahdi
* Carna
* Flame
* FBI
* Shamoon
* Red October
* Dexter

2013|

* DarkSeoul
* CryptoLocker

2014|

* Careto
* DarkHotel
* Duqu 2.0
* Dyreza
* FinFisher
* Brambul
* Destover
* Gameover ZeuS
* Carbanak

2015|

* Dridex
* Rombertik
* TeslaCrypt
* Hidden Tear

2016|

* Hitler
* Petya (NotPetya)
* KeRanger
* Jigsaw
* Pegasus
* Mirai
* X-Agent

2017|

* LogicLocker
* BrickerBot
* WannaCry

2018|

* Kraken

2019|

* ElectricFish
* Grum
* Joanap
* MEMZ
* NetTraveler
* NSA ANT catalog
* R2D2
* Regin
* Tinba
* Titanium
* Vault 7
* X-Tunnel
* ZeroAccess

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/2018 Google data breach. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=2018_Google_data_breach&oldid=4150665"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template