Google is about to have its Cambridge Analytica moment. A security bug allowed third-party developers to access Google+ user profile data since 2015 until Google discovered it in March, but decided not to inform users. When a user gave permission to an app to access their profile data, the bug also let those developers pull their friends’ data. 496,951 users’ full names, email addresses, birth dates, gender, profile photos, places lived, occupation and relationship status were potentially exposed, though Google says it has no evidence the data was misused.

The company decided against informing the public because it would lead to “us coming into the spotlight alongside or even instead of Facebook despite having stayed under the radar throughout the Cambridge Analytica scandal” according to an internal memo.

The news comes from a damning Wall Street Journal report that says Google is expected to announce a slew of privacy reforms today in response to the breach. That includes stopping most third-party developers from accessing Android phone SMS data, call logs, and some contact info. Gmail will restrict building add-ons to a small number of developers. and Google+ will cease all its consumer services. We’ve reached out to Google for comment.

Since the bug and subquent security hole started in 2015 and was discovered in March before Europe’s GDPR went into effect in May, Google will likely be spared a 2 percent of global annual revenue fine for failing to disclose the issue within 72 hours. The company could still face class-action lawsuits and public backlash.

The fiasco could thrust Google into the same churning sea of scrutiny currently drowning Facebook, just as the company feared. Google has managed to float above much of the criticism leveled at Facebook and Twitter, in part by claiming it’s not really a social network. But now its failed Facebook knock-off from seven years ago could drag down the search giant and see it endure increasingly calls for testimony before congress and regulation.