Facebook has discovered a bug which may have affected up to 6.8 million people and given third-party apps wider access to user photos on the social network.
The social media firm said the bug was found in software that used Facebook logins to give third-party apps on the platform permission to access a user’s photos, and was active for 12 days between 13 and 25 September.
The bug meant access was granted to a broader set of user images than intended, Facebook said, including images uploaded to the site but never posted.
“When someone gives permission for an app to access their photos on Facebook, we usually only grant the app access to photos people share on their timeline,” the social media site’s Tomer Bar said.
“In this case, the bug potentially gave developers access to other photos, such as those shared on Marketplace or Facebook Stories.
“The bug also impacted photos that people uploaded to Facebook but chose not to post. For example, if someone uploads a photo to Facebook but doesn’t finish posting it — maybe because they’ve lost reception or walked into a meeting — we store a copy of that photo so the person has it when they come back to the app to complete their post.”
Facebook said it believes the bug affected up to 1 500 apps built by 876 developers.
‘Sorry’
“We’re sorry this happened. Early next week we will be rolling out tools for app developers that will allow them to determine which people using their app might be impacted by this bug,” Bar said. “We will be working with those developers to delete the photos from impacted users.
“We will also notify the people potentially impacted by this bug via an alert on Facebook. The notification will direct them to a Help Centre link where they’ll be able to see if they’ve used any apps that were affected by the bug.”
The social network recommended that users log into any apps, which they have previously given access to their photos, to check which images the app has access to.
The incident is the latest in a series of data breaches to hit the social network this year, following the Cambridge Analytica scandal and another leak in September which affected around 29 million users.
The Irish Data Protection Commission, the lead supervising authority for Facebook in the EU, confirmed it was aware of the incident and was investigating Facebook’s compliance with the General Data Protection Regulation (GDPR), introduced earlier this year.
“The Irish DPC has received a number of breach notifications from Facebook since the introduction of the GDPR on 25 May 2018,” the commission’s head of communications, Graham Doyle, said.
“With reference to these data breaches, including the breach in question, we have this week commenced a statutory inquiry examining Facebook’s compliance with the relevant provisions of the GDPR.”
The maximum fine the EU can levy for breaking GDPR rules is 4% of a company’s annual revenue, or around £1.2-billion in Facebook’s case.
