BackBlaze mistakenly shared backup metadata with Facebook

Backblaze has removed Facebook tracking code (also known as an advertising pixel) accidentally added to web UI pages only accessible to logged-in customers.

The US-based cloud storage and online backup provider has customers from 175 countries and stores over 1 Exabyte of customer data on its servers.

The tracking code was inadvertently added with a new Facebook advertising campaign that started on On March 8, said Yev Pusin, Backblaze’s Senior Director Of Marketing.

Backblaze discovered the issue after receiving user reports on March 21 that pages on the B2 web UI were sending file names and sizes to Facebook.

Tracking code active for two weeks

While the Facebook advertising pixel used in such campaigns is ordinarily used only on marketing pages, this campaign was accidentally configured to run on all platform pages, including web UI pages only accessible to logged-in users.

“We promptly investigated the matter and, once we were able to identify, verify, and replicate the issue, we removed the offending code from the signed-in pages on March 21,” Pusin said.

“Our Engineering, Security, and Compliance/Privacy teams—as well as other staff—are continuing to investigate the cause and working on steps to help ensure this doesn’t happen again.”

The third-party tracking code was only deployed on the b2_browse_files2.htm web UI page, which allows users to browse their B2 Cloud Storage files as Backblaze found after investigating the incident.

No account info or files share with Facebook

Backblaze discovered that 9,162 users visited that page while the Facebook campaign was active (between March 8 and March 21).

While the campaign ran, the third-party tracking code collected file and folder metadata such as file names, sizes, and dates and uploaded it to Facebook’s servers.

Luckily, this happened only for customers who clicked to preview file information while browsing through their B2 Cloud Storage files.

Pusin added that no user files or user account info was sent to Facebook while the tracking code was active on signed-in pages.

“No actual files or file contents were shared at any time. The data that was pulled did not include any user account information,” he said.

“Backblaze did not intentionally share this data with Facebook, nor did Backblaze receive any form of compensation for it.”

Source: https://www.bleepingcomputer.com/news/security/backblaze-mistakenly-shared-backup-metadata-with-facebook/