Active discussions

Please or to access all these features

Talk
Site stuff

Join our Innovation Panel to try new features early and help make Mumsnet better.

See all MNHQ comments on this thread

MNHQ

Mumsnet Data Breach - Q&A

189 replies

JustineMumsnet · 19/04/2018 21:04

As many of you already know, some screenshots of Mumsnet posts were recently uploaded to Twitter by a former Mumsnet intern – here’s a link to a previous thread discussing this in case you've not seen it.

Three of the screenshots showed an Admin’s view of the site and therefore contained the IP addresses of the posters concerned.

Understandably there have been loads of questions about the implications, about what data we hold and who has access to it so we've collated them here. Please do post any queries here or email [email protected] if you’ve any concerns or further questions.

Thanks and huge apologies if this has caused you any concern.

OP posts:
MNHQ
KateMumsnet · 19/04/2018 22:07

If I signed up with an email but then changed my account details and switched to a different one, then is my old one still visible to the mods or is it just the current one?

Yes, the old email is still visible, @chardonnaysPrettySister.

ChampiontheWonderHamster · 19/04/2018 22:07

This reply has been deleted

Message withdrawn at poster's request.

DarthArts · 19/04/2018 22:07

Thanks @JustineMumsnet

MNHQ
JustineMumsnet · 19/04/2018 22:05

I'm going to sign off now but will be back tomorrow (god willing).

OP posts:
MNHQ
JustineMumsnet · 19/04/2018 22:04

@MipMipMip

Why, when you have had a data leak before, was this able to happen? Why did you not implement a disaster plan?

I'm not sure the two are related MMM. In the last instance we were phished, swatted and ddos-ed. Following that we took measures to implement extensive firewalls and regular stress testing and white hack attempts. There have been multiple ddos attacks on MN since none of which I'm pleased to say have brought the site down (touches wood and everything else).

This breach was an employee taking screen grabs of user posts while she was logged in as an admin.

OP posts:
LovesLaboursLost · 19/04/2018 22:03

What about the embedded data in photos posted on Mumsnet? I understand this is no longer publicly accessible, but can people like this intern access it?

MargeH · 19/04/2018 22:03

Was Emma only able to access the admin control panel on her work PC, or did she have automatic admin rights if logging in on her personal devices too?

DarthArts · 19/04/2018 22:02

@merrymouse

Shame on me, but no.

I confess I've not been intersectional on my toilet cleaning.

Look folks - Ariel has 51 follows on twitter. Not exactly an influence even within their own bubble.

Just trying to create some balance here wrt the veracity and reach about what's being posted.

MipMipMip · 19/04/2018 21:59

Why, when you have had a data leak before, was this able to happen? Why did you not implement a disaster plan?

MipMipMip · 19/04/2018 21:58

Why are you saying apologies if this has caused you any concern instead of apologies for being so lax in allowing this to happen?

Given EH has been very vocal in the past about trans rights, #nodebate etc why was she able to get to this point and not screened out? How are you preventing that in future?

MipMipMip · 19/04/2018 21:55

Where pwople habe won competitions or done secret santa etc you had their address. Was this deleted immediately? If not, why not and how is/was it stored?

You said in your statement Emma had no more data. In the Guardian article it said she had promised to delete further data. Which is correct?

Are past email addresses/passwords kept on your system when they have been changed?

Have you checked there is no malware etc that has been left to provide back door entry?

merrymouse · 19/04/2018 21:53

I'd put less faith in anything "Ariel" had to say than a MNetter arguing a loo brush is sanitary.

Follow up question. Have you checked whether any of your employees have connections to ‘Addis’, ‘Toilet Duck’ or ‘Harpic’? Grin

RoseAndRose · 19/04/2018 21:53

If there are no audit trails, then you cannot say what he has done on the system. And if I understood correctly from yesterday's posts, for 5 of her 6 months with you, she had unfettered access to members' personal data.

It seems you only have her word about her activities.

MNHQ
JustineMumsnet · 19/04/2018 21:52

@KatherinaMinola

Repeating my question (also asked by other people) from the previous thread:

Are you conducting an investigation into Emma Healey's claims that she still has friends at MN who might make moderation decisions at her suggestion? Because we don't know what else they might do at her suggestion.

As I've said a few times I think Emma's comments about "getting her friends to delete things" were a bit self-aggrandising. There is no evidence of anyone on our staff mis-using mod powers. We've obviously raised the way we mod Trans issues internally and one or two of our team have said they're worried we're not being thorough enough in deleting things that are mean. This is something we'll continue to discuss to make sure we moderate fairly. But I don't believe we have any one who poses a risk to user data on the current team.

OP posts:
ObiJuanKenobi · 19/04/2018 21:50

Thanks for replying @JustineMumsnet I thought so too but it's so hard to know!

I think we all forget sometimes how easy it is to post so much about our lives, often things we don't even talk to people about in RL for one reason or another, yet here has always felt like a safe space to really share and get some genuinely great help, often at life's lowest moments - you don't stop to think something like this could potentially happen and your online safe space could suddenly become very threatening to your RL circumstances.

I hope EH understands the severity her actions could and still potentially will have on real peoples lives. We deserve a place like mumsnet, it's fab, but we also deserve to feel safe and have our data and identities protected.

Ihavenofuckstogive · 19/04/2018 21:49

The 'Ariel' post said 'more TERF names could be released'.

None have at all so not sure why 'more' would be a worry let alone the Tweet be reported to the Police.

DarthArts · 19/04/2018 21:48

Ariels twitter feed is a mess tbh.

I'd honestly not view it a a reliable source on anything.

RefuseToDenounceBiology · 19/04/2018 21:46

  1. What other investigation are you undertaking to assess the full extent of the stolen information ie IT forensics?

  2. How are you impressing upon your staff the physical danger that leaked data can put members & their families in ie DV & family annihilation?

  3. What other efforts are you making to get Emma to admit the full extent of her theft and proof of its deletion?

  4. What investigations are you undertaking into the current staff team to ensure they don't also share Emma's authoritarian views?

  5. What measures are you taking to ensure that only select, trusted staff can access username history?

DarthArts · 19/04/2018 21:45

@JustineMumsnet

ThanksGin

LineyHasntLeftTheBuilding · 19/04/2018 21:44

The recent twitter post by 'Ariel' (see other thread) is really worrying saying more data is to be released over the weekend

Really? Missed that. A tad concerning.

MNHQ
JustineMumsnet · 19/04/2018 21:44

@ObiJuanKenobi

The recent twitter post by 'Ariel' (see other thread) is really worrying saying more data is to be released over the weekend. *@JustineMumsnet* can you offer any reassurances on its legitimacy?

I can't I'm afraid. But I'm sceptical for sure. I strongly suspect it's being done to inflame but can't confirm that.

OP posts:
MNHQ
JustineMumsnet · 19/04/2018 21:42

@merrymouse

From previous thread:

Why do you think EH posted screenshots from her work computer when the posts she put on twitter are visible on the MN website to anyone with an internet connection?

Why use screenshots from her work account after she left?

I think she'd saved them/ previously sent them to someone. I think the piece in the Sunday Times prompted her to look them up and use them. But I'm speculating of course - I can't be 100% sure.

OP posts:
DarthArts · 19/04/2018 21:42

I'd put less faith in anything "Ariel" had to say than a MNetter arguing a loo brush is sanitary.

MNHQ
JustineMumsnet · 19/04/2018 21:41

@Mogleflop

Hi again Justine! Does your database allow audit trails? Can you see if she's accessed information for key vocal people (like Datun?)

Also on another note how are you doing? I hope there hasn't been too much personal nastiness after speaking up in the Times?

No I don't believe we can do this from my initial conversations with Tech - I will explore further however. And I'm ok thanks - I'm staying off Twitter except to post pictures of gin...

OP posts:
KatherinaMinola · 19/04/2018 21:41

Justine has replied on that thread, merry