Facebook bug exposes photos of up to 6.8 million users

Facebook has discovered a bug which may have affected up to 6.8 million people and given third-party apps wider access to user photos on the social network.

The social media firm said the bug was found in software that used Facebook login to give third-party apps on the platform permission to access a user’s photos, and was active for 12 days between September 13 and 25.

The bug meant access was granted to a broader set of user images than intended, Facebook said, including images uploaded to the site but never posted.

“When someone gives permission for an app to access their photos on Facebook, we usually only grant the app access to photos people share on their timeline,” the social media site’s, Tomer Bar, said.

“In this case, the bug potentially gave developers access to other photos, such as those shared on Marketplace or Facebook Stories.”

(Niall Carson/PA)

“The bug also impacted photos that people uploaded to Facebook but chose not to post. For example, if someone uploads a photo to Facebook but doesn’t finish posting it – maybe because they’ve lost reception or walked into a meeting – we store a copy of that photo so the person has it when they come back to the app to complete their post.”

Facebook said it believes the bug affected up to 1,500 apps built by 876 developers.

“We’re sorry this happened. Early next week we will be rolling out tools for app developers that will allow them to determine which people using their app might be impacted by this bug,” Mr Bar said.

“We will be working with those developers to delete the photos from impacted users.

“We will also notify the people potentially impacted by this bug via an alert on Facebook. The notification will direct them to a Help Center link where they’ll be able to see if they’ve used any apps that were affected by the bug.”

The social network recommended that users log into any apps, which they have previously given access to their photos, to check which images the app has access to.

The incident is the latest in a series of data breaches to hit the social network this year, following the Cambridge Analytica scandal and another leak in September which affected around 29 million users.

The Irish Data Protection Commission, the lead supervising authority for Facebook in the EU, confirmed it was aware of the incident and was investigating Facebook’s compliance with the General Data Protection Regulation (GDPR), introduced earlier this year.

“The Irish DPC has received a number of breach notifications from Facebook since the introduction of the GDPR on May 25 2018,” the commission’s head of communications Graham Doyle said.

“With reference to these data breaches, including the breach in question, we have this week commenced a statutory inquiry examining Facebook’s compliance with the relevant provisions of the GDPR.”

The maximum fine the EU can levy for breaking GDPR rules is 4% of a company’s annual revenue, or around £1.2 billion in Facebook’s case.

- Press Association

More in this Section

Should you buy… the Samsung Galaxy S10+?

God Of War leads Bafta game award nominations

Facebook launches new AI detection tool to help revenge porn victims

Apple labels Spotify anti-competition complaint ‘misleading rhetoric’


Lifestyle

Debate: Should you drink in front of your children?

Interiors profile: Senior Designer at DFS Rob Ellis

Are you drinking out of the right wine glass?

Tempted to renovate your home? TV’s Kunle Barker shares 4 top tips for getting started

More From The Irish Examiner