The Supreme Court on Monday left in place a lower court decision allowing Google investors to proceed with a claim that the company misled them by waiting too long to disclose a data breach.

As is customary, the justices didn’t say why they rejected Google’s request to intervene in the matter.

The battle between Google and the shareholders centered on Google’s delay in disclosing a bug that allowed outside developers to access private information about Google+ users — including their birth dates, photos, occupations, and addresses. (Google shut down Google+ in 2019.)

Google allegedly learned of the security glitch in March 2018, and fixed it by April. But the company didn’t publicly disclose it until October 2018.

Google reportedly held off on disclosing information about the glitch because it feared regulatory scrutiny and bad publicity.

Investors led by the treasurer of Rhode Island (on behalf of the state’s pension system) alleged in a lawsuit that Google violated securities laws by failing to reveal the data breach in the company’s April or July 2018 filings with the Securities and Exchange Commission.

U.S. District Court Judge Jeffrey White in San Francisco dismissed the investors’ complaint. He ruled that even if the allegations in the complaint were true, they show that Google had made any false or misleading statements in its regulatory submissions. White also noted in his decision that Google had already remedied the software bug before its April 2018 filing.

A three-judge panel of the 9th Circuit reversed White’s decision. Those judges said the investors’ complaint raised the inference that the company made a decision to deliberately conceal the cybersecurity bug.

Last year, Google asked the Supreme Court to review that ruling, arguing that the decision could affect a broad array of companies.

Google wrote that the 9th Circuit’s decision effectively requires all companies that collect data to disclose “every security or data privacy bug they have experienced, no matter how large or small, and no matter how far in the past, even if it was easily fixed and did not cause consumers harm.”

News of the data breach also led to a class-action lawsuit on behalf of users, which Google settled for $7.5 million.