Google has agreed to pay $350 million to resolve a shareholders lawsuit from 2018 concerning a vulnerability in its discontinued Google Plus platform, which resulted in third-party exposure of data belonging to millions of users, reports The Record, a news site by cybersecurity firm Recorded Future.
Such a breach compromised individuals' full names, birthdates, gender, email and home addresses, profile pictures, occupations, and relationship status, according to a 2018 report from The Wall Street Journal, which noted that the security issue was only remediated in March of the same year despite beginning three years prior. Google was also noted by The Journal of having its senior executives advised not to publicly disclose the data exposure, a plan which was also known by Google CEO Sundar Pichai.
"We regularly identify and fix software issues, disclose information about them, and take these issues seriously. This matter concerns a product that no longer exists and we are pleased to have it resolved," said Google spokesperson Jose Castaneda.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.