Backblaze has removed Facebook tracking code (also known as an advertising pixel) accidentally added to web UI pages only accessible to logged-in customers.
The US-based cloud storage and online backup provider has customers from 175 countries and stores over 1 Exabyte of customer data on its servers.
The tracking code was inadvertently added with a new Facebook advertising campaign that started on On March 8, said Yev Pusin, Backblaze's Senior Director Of Marketing.
Backblaze discovered the issue after receiving user reports on March 21 that pages on the B2 web UI were sending file names and sizes to Facebook.
Developers and IT people can now build their own cloud storage solutions with Backblaze. Using our storage pods you can build applications, host content or build your very own backup service on B2. Backblaze offers a huge discount over other cloud providers at. Backblaze is being used to backup user's data to Backblaze's cloud. This off-site backup strategy lets me be assured that my data will be secure should tragedy ever strike (flood, fire, etc.). Backblaze does this backup unobtrusively, users hardly notice the applications is ever backing up their data in the background because it does so.
Tracking code active for two weeks
While the Facebook advertising pixel used in such campaigns is ordinarily used only on marketing pages, this campaign was accidentally configured to run on all platform pages, including web UI pages only accessible to logged-in users.
'We promptly investigated the matter and, once we were able to identify, verify, and replicate the issue, we removed the offending code from the signed-in pages on March 21,' Pusin said.
'Our Engineering, Security, and Compliance/Privacy teams—as well as other staff—are continuing to investigate the cause and working on steps to help ensure this doesn't happen again.'
The third-party tracking code was only deployed on the b2_browse_files2.htm web UI page, which allows users to browse their B2 Cloud Storage files as Backblaze found after investigating the incident.
No account info or files share with Facebook
Backblaze discovered that 9,245 users visited that page while the Facebook campaign was active (between March 8 and March 21).
While the campaign ran, the third-party tracking code collected file and folder metadata such as file names, sizes, and dates and uploaded it to Facebook's servers.
Luckily, this happened only for customers who clicked to preview file information while browsing through their B2 Cloud Storage files.
Backblaze Twitter
Pusin added that no user files or user account info was sent to Facebook while the tracking code was active on signed-in pages.
Backblaze Twitter Codes
'No actual files or file contents were shared at any time. The data that was pulled did not include any user account information,' he said.
'Backblaze did not intentionally share this data with Facebook, nor did Backblaze receive any form of compensation for it.'
Related Articles:
