The bug allowed apps users had approved to pull their timeline photos to also receive their Facebook Stories, Marketplace photos, and most worryingly, photos they'd uploaded to Facebook but never shared. Facebook says the bug ran for 12 days from September 13th to September 25th. Facebook tells TechCrunch it discovered the breach on September 25th, and informed the European Union's privacy watchdog the Office Of The Data Protection Commissioner (IDPC) on November 22nd. The IDPC has begun a statuatory inquiry into the breach.

Facebook provided merely a glib "We're sorry this happened" in terms of an apology. It will provide tools next week for app developers to check if they were impacted and it will work with them to delete photos they shouldn't have. The company plans to notify people it suspects may have been impacted by the bug via Facebook notification that will direct them to the Help Center where they'll see if they used any apps impacted by the bug.