1. Home >
  2. Internet & Security

Facebook Might Have Leaked Your Private Photos

Even if you never made a photo public, an app developer may have it.
By Ryan Whitwam
563109-facebook-icon-cc0-license
It's been at least a few days since a new Facebook privacy scandal dropped, so we're long overdue. According to a new posting tucked away on Facebook's developer blog(Opens in a new window), the company introduced a bug into its photo API earlier this year that gave connected apps too much access to your pictures. Even if you never made a photo public, an app developer may have it. We have seen a few social network API fails lately -- most notable on Google's now-doomed Google+ platform. However, those vulnerabilities just covered profile fields rather than your photos. The broken API is supposed to only grant access to photos shared to your timeline. Apps using the API from September 13 to September 25 could also see your photos from the Marketplace, Facebook Stories, and even photos you uploaded and chose not to share. The API bug may have affected as many as 6.8 million users -- anyone who connected around 1,500 different apps from 876 developers that accessed the photo API. Facebook offered a rather generic apology, saying, "We're sorry this happened." Since this is the developer-oriented alert, Facebook discusses the next step in determining how much data leaked. Starting next week, it will roll out tools for developers to determine which of their users might have been affected and delete photos those apps may have incorrectly stored. That will give Facebook a better idea of how severe the leak was. Facebook says it will notify users of the breach via an alert in their feed (see below). It will include information on the apps they've used that could have gotten private photos. At that point, they can check those apps to see if they contain photos that weren't shared to the timeline. The company claims to have notified(Opens in a new window) Europe's Office Of The Data Protection Commissioner (IDPC) of the breach as required by the wide-ranging GDPR rules implemented earlier this year. However, Facebook did not do so until Nov. 22nd. It discovered the breach on Sept. 25th, and the GDPR requires companies to notify the EU within 72 hours. Facebook says it didn't know if the error would constitute a GDPR report until November, but that seems suspicious. The IDPC has started an inquiry that could result in a substantial fine for Facebook. Facebook says the vulnerability is patched, so your private photos are again safe and sound. Further, the breach never impacted photos shared through Messenger or other Facebook services like Instagram and WhatsApp. Now read:

Tagged In

Facebook Photos Privacy

More from Internet & Security

Subscribe Today to get the latest ExtremeTech news delivered right to your inbox.
This newsletter may contain advertising, deals, or affiliate links. Subscribing to a newsletter indicates your consent to our Terms of use(Opens in a new window) and Privacy Policy. You may unsubscribe from the newsletter at any time.
Thanks for Signing Up