Facebook has revealed that a software bug exposed the photos of up to 6.8 million users, including pictures they had not posted.
It made the announcement a day after hosting its pop-up privacy experience “It’s Your Facebook” in New York’s Bryant Park.
It said several third-party apps had access to “a broader set of photos than usual” for 12 days in September.
The company said it would notify affected users.
It is the latest in a series of data breaches at the social network, which has faced scrutiny following the Cambridge Analytica data scandal.