Google did not disclose security breach because it feared regulation, report says

Bloomberg | Bloomberg | Getty Images

Sundar Pichai, chief executive officer of Google Inc., attends a news conference in New Delhi, India, on Wednesday, Jan. 4, 2017. 

Google did not disclose a security breach to its Google+ social network because it feared regulation, according to a Wall Street Journal report citing documents and people briefed on the incident.

A software glitch gave outside developers potential access to the private profile data of hundreds of thousands of Google+ users between 2015 and March 2018, the report says. Alphabet allegedly didn’t disclose the issue when it was first discovered to avoid reputational damage and regulatory scrutiny.

In its own blog post about the bug, Google writes that the possibly exposed data included users’ names, email addresses, birth dates, profile photos, and genders, though not any information related to personal communication or phone numbers. The company says that it found no evidence that any developer misused profile data, though it cannot confirm which users were impacted.

In response, Google plans to shut down all consumer functionality of Google+ over the next ten months, although it will maintain the enterprise version used by its G Suite business customers. Since the social network first launched in 2011, it failed to gain popular appeal and was broken up into separate products in 2015. The blog post states that the consumer version currently has low usage and engagement and that 90 percent of user sessions last less than five seconds.

Google discovered the bug during a comprehensive review of third-party developer access to all Google account and Android device data. Google shares fell more than 2 percent to $1134.23 on the news.

Alphabet didn’t immediately respond to a request for comment.

This story is developing. Please check back for updates.