A government organization in Rhode Island announced on Wednesday that it has filed a lawsuit against Google’s parent company, Alphabet Inc., over the recent security incidents involving the Google+ social network.
The Employees’ Retirement System of Rhode Island filed a motion in the Northern District of California asking to lead a shareholder class action against Alphabet. The Internet giant has been accused of misleading federal regulators and shareholders by failing to “disclose ongoing breaches in private user information from its social media platform Google+.”
“Google had an obligation to tell its users and investors that private information wasn’t being protected,” commented Rhode Island General Treasurer Seth Magaziner. “Instead, Google executives decided to hide the breaches from its users and continued to mislead investors and federal regulators. This is an unconscionable violation of public trust by Google, and we are seeking financial restitution on behalf of the Rhode Island pension fund and other investors.”
The lawsuit focuses on the two recent incidents involving Google+. The first was brought to light in October, when Google announced its decision to shut down the social network. The announcement also disclosed the existence of an API bug that exposed the personal information of as many as 500,000 users.
The company said the flaw, which it had discovered in March, gave hundreds of third-party apps access to information such as name, email address, occupation, gender and age. However, there was no evidence that the vulnerability was actually exploited.
The initial plan was to shut down Google+ by the end of next August, but Google has decided to do it four months earlier, in April 2019, after discovering another API vulnerability, this time one that affected roughly 52 million users.
The recently discovered flaw was introduced in November via a software update and it allowed applications to view profile information, including name, occupation, age, and email address, even if the account was configured to be private.
Shortly after Google disclosed the first incident, a group of US senators sent the company a letter asking for additional information, particularly regarding the decision to keep the incident a secret.
Related: Industry Reactions to Google+ Security Incident
Related: Google Tightens Rules Around App Permissions
Related: New Lawsuit Claims Marriott Still Exposes Customer Information