Mumsnet data breach - please read

Do I need to do anything, I knew there was an issue the other day as I suddenly was unable to log in and then had the reboot and enter my password.. very worrying

Also even with the ISO 27001 doesn't make them immune as all it is is a information security management system.

This is true, but it makes them a lot less vulnerable and it more difficult for a repeat like this to happen.

Given that this is the second issue in the last twelve months, I would consider getting the certification a minimum course of action to help user confidence.

In terms of not using your real information on MN, a similar problems have happened at banks and many of you would be horrified at how bad information security even at banks is. And don't get me started on the NHS.

The real issue is a lack of skills across the board on this subject. MN are not good, but the expectation should be that every user here is safe to use the PM system and have basic details. They should be subject to the same level of expectation as any other institution or company that handles data.

The law on this is going to get tougher, as there are more incidents, and it will cost MN in the long run not to invest in security properly.

After previous breach I have a specific MN email account that's only used to sign in here!

Call me naive, but it honestly wouldn't have occurred to me to do this. We are after all anonymous on here, and while MNHQ have our personal names, emails, etc, I thought - wrongly, as it turns out - that they'd have sufficient security systems in place to keep those private

MN need to set up an urgent helpline for people (who are worried)

Possibly, but doesn't that again raise questions of whether they have the necessary staff to cope? As said earlier, I'd be fascinated to know just how the staffing, especially in IT, really is set up ... especially given they were using volunteers as out of hours moderators?

2254 last night mnhq responded on worralibertys thread about this.

This thread then not posted until midday today? I for one think that's an unacceptably long time to wait to alert users!

I can’t login in thru the app using Facebook but can on safari on my iPhone. Not terribly good result.

Or perhaps you’ve been seeking support for an abusive relationship, life limiting illness, or a problem with a child, and shared personal info over PM?

A public online forum that sells your details is not the place for that. It is simply marketed as such. It's time to wise up.

Oh well I couldn't log back in because I didn't know which email address I had used. So I have a new account, but have been around for a while.

How many times is this going to happen to MN? I suppose though that it is a target because it is mainly a website of women.

No, Blanche. You can de-register your account, but everything you've posted - under any names - will still be there. You'll need to email MNHQ directly to ask them to do it.

[email protected]

Blanche you can do a SAR (subject access request) to MN, which will then show all of the data they hold on you. This then enables you to request deletion of everything. Just deactivating your account doesn’t delete posts etc.

They have 30 days to respond to your request. All info here: ico.org.uk/your-data-matters/your-right-of-access/

If you've sat behind your keyboard for years posting hatred and are now concerned others know who you are and where you live, perhaps it's time to reflect on the type of shit you post on a daily basis.

Or perhaps you’ve been seeking support for an abusive relationship, life limiting illness, or a problem with a child, and shared personal info over PM?

There are many reasons women want to stay anonymous.

windowWAG it doesn’t matter what people post, MNHQ are obliged to protect user’s data as per GDPR law. Which they quite clearly haven’t done.

I don’t think people looking for advice and support are mugs tbh.

WindowWAG I get your point but my main concern is for vulnerable users who've done nothing wrong. Who've posted on here for support regarding dv, health issues, surviving childhood abuse etc they certainly don't deserve for their lives to be made harder than they already are.

Is there a way to deactivate my account and will that delete everything I've posted and under name changes also?
I can't be on here anymore when it isn't safe.

I used to use my username to login but haven't been able to for years I think its been fb, !inked or whatever, or my email address. I wasn't aware any could still log in using their username!

I have never wanted to allow global logins, like fb or other white unstrusted info greedy grabbers.

But most of what google et al are doing now is from voice recordings and images taken by stealth and selling that for huge mark up.

I know many a user will argue thats simply not true but it absolutely is.

Yes we need reassurance that we're not going to have our usernames used & possibly abused by others.

" Surely that's the heart of the problem - that others could post under someone else's username! Could say all sorts of offensive shit that could get them banned or even prosecuted"

This is what im very worried about too.

Started typing at 1549

I actually noticed a problem with password not being asked for AND REPORTED IT a few days ago - I've still not had a response to that.

When were you first made aware of the issue? Given its now late Thursday afternoon and you say the problem has been since Tuesday and we're only just being told?

Due to an issue I had on another site I use an email address I only use for this site. Fake name too. Thank god for that!

What I wish I'd raised before is the RIDICULOUS amount of spam I get to that account - now I'm thinking about it, given mn are the ONLY people I've EVER given this address to I'd like to know HOW these companies HAVE this address? Are you selling users email addresses? Or is your data security SO lax that it's easy for people to access users emails? Neither answer is particularly reassuring.

I've been using the app for last few hours with NO notification of this nor was I required to log in!

I only came to the site because a post I was trying to put on a thread wasn't working (on the app longer posts or ones with lots of punctuation often refuse to post).

I've been using the app for months BECAUSE the site is an absolute nightmare to use on safari AND HAS BEEN FOR MONTHS!

Very occasionally it works for one post but the longer I use it the slower and more gobbledegook it gets!

I'm a relatively new user but I've seen posts and read up on the previous issues mn has had with security etc and I must admit it's concerning that you seem to have such a blasé attitude.

I believe also as a business mn is quite successful in terms of profit? but yet you don't seem to be able to find IT contractors that can effectively manage that side including the security? Bit worrying for users.

I'm lucky enough this doesn't apply to me but it must be of particular concern to those mners with abusive, even violent exes who's private information could be used to create real life problems for them. What are mn doing to address this possibility? That's in addition to those being threatened by TRA's by the way.

"Hi CallMe, the app isn't affected by this breach. So no forced login required on that. (nb Passwords weren't able to be accessed anywhere either)" I find that response even MORE worrying! Has this just been assumed or has it been RIGOROUSLY checked? And even if it's been checked surely it would be better to err on the side of caution and force log out everyone on the app too - if for no other reason than to alert them to the fact there's been a problem! As I say I've been using app last few HOURS jumping between I'm on and active and this thread didn't show at all. I had NO IDEA there was a problem.

"Given today’s issues, we are going to forcibly log out all app users in the next 30 minutes." Really? I used the app since that point without having to log in.

"but you shouldn't be able to load the list of threads I'm watching. Apologies for the lack of clarity." That doesn't make sense. Most users will float between I'm on, active and topics. Certainly I rarely use I'm watching because it lists every thread you've even glanced at!

This thread is now showing on the app in active but that's only been in last 10 mins (time of typing 1627).

"Couldn't you have registered using your usual name but with maybe a slight variation of the spelling At4oclockthenormalworld?
I doubt anyone would have noticed a subtle change?" Equally someone could "steal" their username this way, no way for other users to know if it were the "genuine" person who'd been using the original username. Surely that's the heart of the problem - that others could post under someone else's username! Could say all sorts of offensive shit that could get them banned or even prosecuted!

I'd like to know which Company mumsnet paid to do this migration. They have properly ballsed up.

I still can’t change my password either. wanted to do it as matter of security but it just refreshes or sends me to the Mumsnet homepage.