Facebook has officially announced that a bug on its network has exposed photos of 6.8 million users without their consent. The social network states that a photo API bug gave third-party app developers access to users’ photos they may not have publically shared.
“Photos that users started to upload to Facebook but did not post could have been accessed, along with images posted to Facebook Stories. We’re sorry this happened,” wrote Tomer Bar, an engineering director at Facebook, in a blog post.
According to Facebook, photos could have been accessed by 1500 apps created by 876 developers as a result of this bug. Next week, the company plans to offer tools for app developers which will allow them to find users that may have been impacted by the bug.
Besides, the company added it will notify users who may been affected by the bug through a Facebook notification that will redirect them to the Help Centre. You can find a mock-up of that notification in the image below:
“Currently, we believe this may have affected up to 6.8 million users and up to 1,500 apps built by 876 developers. The only apps affected by this bug were ones that Facebook approved to access the photos API and that individuals had authorized to access their photos,” further explained Facebook.
Facebook added that the bug was live for 12 days from September 13th to September 25th. The company said it discovered the bug on September 25th, and informed the Office of Data Protection Commissioner (IDPC) on November 22nd.
As to why they waited so long to disclose the bug, Facebook reportedly said that it took time to investigate the issue and find out how many users were affected.
For now, Facebook recommends users to log into any apps with which they might’ve shared their Facebook photos with to find out which photos they’ve gained access.
