2011-2019 Google+

Attachments

2016-2021 Poole was hired by Google in 2016 to work on the Google+ social network,[3] and left the company in 2021.[4]
2018 But Google just found that data was available to developers, not that any data was actually taken. With no clear data stolen, Google had no legal reporting requirements.
2018 For months, Google has been trying to stay out of the way of the growing tech backlash, but yesterday, the dam finally broke with news of a bug in the rarely used Google+ network that exposed private information for as many as 500,000 users.
2018 Google found and fixed the bug back in March, around the same time the Cambridge Analytica story was heating up in earnest. But with the news breaking now, the damage is already spreading.
2018 The Verge -The breach that killed Google+ wasn't a breach at all
Christopher "moot" Poole
The API was theoretically accessible to anyone who asked, but only 432 people actually applied for access (again, it's Google+), so it's plausible that none of them ever thought of using it this way.
The consumer version of Google+ is shutting down, German privacy regulators in Germany and the US are already looking into possible legal action, and former SEC officials are publicly speculating about what Google may have done wrong.
The vulnerability itself seems to have been relatively small in scope. The heart of the problem was a specific developer API that could be used to see non-public information.