In the wake of news reports about previously undisclosed security vulnerabilities at the flagging social network Google+, Alphabet Inc. and Google Inc. were hit Monday with a lawsuit claiming that Google+ allowed third-party application developers access to users’ private profile data between 2015 and March 2018.

“While this information was supposed to be protected, and shared only with expressed permissions and limitations, defendants allowed third-party application developers to improperly collect the personal information of up to 500,000 Google+ users,” wrote lawyers representing two plaintiffs, Google+ account holders from California and Florida.