Facebook Reveals New Data Leak Incident Involving Groups’ Members

Facebook today revealed yet another security incident
admitting that roughly 100 app developers may have improperly
accessed its users’ data in certain Facebook groups, including
their names and profile pictures.

In a blog
post^[1] published Tuesday,
Facebook said the app developers that unauthorizedly access this
information were primarily social media management and video
streaming apps that let group admins manage their groups more
effectively and help members share videos to the groups,
respectively.

For those unaware, Facebook made some changes to its Group API
in April 2018, a month after the revelation of the Cambridge Analytica
scandal, limiting apps integrated with a group to only access
information, like the group’s name, the number of members and the
posts’ content.
^[2]

To get access to additional information like names and profile
pictures of members in connection with group activities, group
members had to opt-in.

However, it seems like Facebook once again failed to protect
its users’ information^[3]
despite the company changing its Group API access parameters back
in April 2018.

In an ongoing review, Facebook said it found that the developers
of some apps retained the ability to access Facebook Group member
information from the Groups API for longer than the company
intended.

Though Facebook did not disclose the total number of users
affected by the leak or if the data also involved other information
beyond just names and profile pictures, the company did assure its
users that it stopped all unauthorized access to the data and that
it found no evidence of abuse.

Facebook also believes that the number of app developers that
actually accessed this data is smaller and decreased over time, as
it says that of roughly 100 app developers retaining user data
access through Groups API since the last 18 months, “at least 11
partners accessed group members’ information in the last 60
days.”
In July, Facebook agreed to pay a $5 billion
fine^[4] as a settlement with the
Federal Trade Commission (FTC) over the Cambridge Analytica
scam^[5] and also accepted a
20-year-long agreement with the FTC that enforces new guidelines
for how the social media handles its users’
privacy^[6] and their data.

In the recent news surrounding the social media giant, Facebook
sued Israeli mobile
surveillance firm NSO^[7]
Group late last month for its involvement in hacking WhatsApp
users^[8], including diplomats,
government officials, human rights activists, and journalists,
using its well-known spyware called Pegasus^[9].