Active discussions

Please or to access all these features

Talk
Site stuff

Join our Innovation Panel to try new features early and help make Mumsnet better.

See all MNHQ comments on this thread

MNHQ

Mumsnet data breach - please read

868 replies

JustineMumsnet · 07/02/2019 12:40

As some of you know, we're very sorry to say that we’ve become aware of a data breach which affected some Mumsnet user accounts

What happened?
There was a problem affecting Mumsnet user logins between 2pm of Tuesday 5 February and 9am on Thursday 7 February 2019. During this time, it appears that a user logging into their account at the same time as another user logged in, could have had their account info switched.

Why has this happened?
We believe that a software change, as part of moving our services to the cloud, that was put in place on Tuesday pm was the cause of this issue. We reversed that change this morning. Since then there have been no further incidents.

How did Mumsnet find out this was happening?
Late last night, a Mumsnet user alerted us to the fact that they were able to log in to and view the details of another user’s account.

What information could have been affected?
If someone other than you logs into your account, they can see:
your email address
your account details
your posting history
your personal messages

They would NOT have been able to see your password because that data is encrypted and they would not have been able to change your password because you need to input a password to do that.

How many people are affected?
At the moment, we don’t know for sure but we are investigating the logs and hope to know definitively very soon. We do know that approximately 4000 user accounts were logged into in the period in question but we don’t as yet know which of those were actually breached (ie also affected by a mismatched login), although we know for sure it wasn’t every account. We have been made aware by users of 14 incidents when this occurred and have contacted the individuals that we know were affected. We are working hard to establish if there were more.

What have you done about it so far?
We’ve reversed the software change that was made on Tuesday pm, and this morning we forced a log out, requiring users to log in again before they can post. This ensures that anyone who had inadvertently logged in as someone else will no longer be logged in to the wrong account.

Where can I get updates?
We’re posting about the situation on this thread, and will update as and when we have further relevant info.

What happens next?
When we have any further substantial information affecting the security of Mumsnet user accounts we will send another email and post on the site.

We’re very sorry.
You’ve every right to expect your Mumsnet account to be secure and private. We are working urgently to discover exactly how this breach happened and to learn and improve our processes. We will also keep you informed about what is happening. We know some of you will be very worried by the possibility that your account has been breached - please mail us on [email protected] if you’d like to discuss your individual account details. We will of course be reporting this incident to the Information Commissioner.

Thanks to all who brought this to our attention.

Justine

OP posts:
Thread gallery
5
NerrSnerr · 07/02/2019 15:14

It does sound as if some posters are not using special purpose emails and are using real names and addresses and possibly other info.

This only applies if people post things on Mumsnet that they wouldn't want anyone else to know (just in case anyone is panicked by that statement). Not everyone posts sensitive information or personal information you wouldn't want to share.

butterflymum · 07/02/2019 15:10

@runoutofnamechanges

Thanks for reminder re checking recent activity on mail client. Haven't looked for ages, but having just checked the email account I use for this site.

Whilst results are unlikely to be connected to this current event (except perhaps the entry on TuesdY 5th?), it was a sharp reminder to check it more frequently, as it reported several, thankfully blocked, attempts at accessing my mail account.

Mumsnet data breach - please read
easyandy101 · 07/02/2019 15:08

Can't believe people put so much identifying info about themselves on mn

The board itself and how prang and name changy everyone is would make you think it would all be burner emails and nothing linking back to real you

Shock
HankNPat · 07/02/2019 15:08

So finally MNHQ stickies this thread in Site Stuff and AIBU at nearly 1pm today - but still hasn't stickied it in Chat as well. Why on earth not?

BeneathTheBoughs · 07/02/2019 15:07

I don't think your posts belong to you once they are on the site but to Mumsnet. Hence, the reason they can sell/allow other sites to use them as they want.

Mumsnet - please clarify - is this correct?

Openup41 · 07/02/2019 15:03

This reply has been deleted

Withdrawn at poster's request.

Xenia · 07/02/2019 15:03

new, you were logged out as everyone was so that you would have to re-enter your password on login. It was a sensible thing for MN to do.

On deleton of past messages it probably depends what the terms and conditions say. I suspect a past anonymous message may not be personal data with a right of deletion under data protection laws but I may be wrong. In fact it would be useful to know. If the message can identify someone (eg some of my posts could be used to find out my real identity then even a supposedly anonymous post might become identifable personal data)

Openup41 · 07/02/2019 15:00

This reply has been deleted

Withdrawn at poster's request.

BeneathTheBoughs · 07/02/2019 15:00

So the site is not letting me change my password as it won't recognise my current password, yet it will let me post here???

What a shambles. As a commercial organisation, you can't just take all the ad money and all the payments for selling the posts to the Daily Mail etc, then just not bother sorting out the IT security properly.

paxillin · 07/02/2019 14:59

Where did you see MNHQ is contacting the ICO, @WonderTweek?

Have you contacted the ICO, MNHQ?

Jayne35 · 07/02/2019 14:57

Just changed my registered email to a hardly used one and took out all personal info, as this is not the first issue I don't want to have my real info on this website anymore. Hoping that will get rid of the old info though otherwise I'll need to close and open a new account.

Cluckinghell · 07/02/2019 14:52

'These things happen, no harm done'

Of course harm could be done.
I've never known anywhere as shit as Mumsnet for data breaches tbh.

LikeACowsOpinion · 07/02/2019 14:48

@Wedgiecar58 I read it as if you were logging in during those times - since the swap of details was occurring because two users were logging in at the same time.

No need to get the arse about it. Pretty understandable to want full clarification about a situation such as this.

bellinisurge · 07/02/2019 14:45

All weird and chaotic. Really would expect better.

LikeACowsOpinion · 07/02/2019 14:44

I thought there was no problem with the app? I've just been logged out.
Using iOS on iPhone.

Really getting quite worried now MNHQ.

newnameforthis7 · 07/02/2019 14:42

I wonder why I'd been logged out! I thought I'd been suspended or something. Blush I was trying to think what I could have said to offend someone.

@PearsandWine

It does sound as if some posters are not using special purpose emails and are using real names and addresses and possibly other info.

Irrespective of anything else PLEASE don't use your real details for any SM site inc MN and FB. If you have please deregister and re-register.

I agree with this. I have a throwaway address for mumsnet, and my real name is not on here. Not even my real location. I don't think ANYone who accessed my account could possibly find out anything personal about me. Even if they accessed my email, they would only find emails from mumsnet/about mumsnet, like notifications and so on! I haven't even got any private messages.

I would be very worried if I used an email address with my real full name though, or if I was someone who used facebook to log in! Shock

I always use throwaway email addresses without my real name for forums such as this. As the poster above said, maybe everyone who is registered with an email address that identifies them (or is on here via their facebook,) should deregister, and re-register under a throwaway name and email address.

WhenLifeGivesYouLemonsx · 07/02/2019 14:42

I was logged out too.

LIZS · 07/02/2019 14:41

I've only just been logged out on the ios app.

SassitudeandSparkle · 07/02/2019 14:41

This sounds awfully like you are examining some kind of manual records to see who was logged in at the same time rather than just having a ready report of the login clashes. It's not comforting tbh.

Judashascomeintosomemoney · 07/02/2019 14:37

MNHQ believe it's the software change, but don't know for sure?
We're pretty certain of this, yes (and as said there have been no problems since we reversed the change). We should be able to confirm it unequivocally in due course, but we do think we should rule out every possible other explanation and leave no possible stone unturned before we say we're 100% sure

So you have gone live with a software update, that has affected data indexing, without any testing of the software whatsoever? Even a cursory basic test of the software update, prior to going live with it, should have thrown up issues with data indexing.
I personally have no concerns about who may have seen my data but that clearly puts me in a tiny minority of users of this site. Yet again a breach and yet again the breezy ‘ooh, whoops, silly us! ‘ attitude. Who runs your IT department, Roy and Moss?

spinabifidamom · 07/02/2019 14:34

There have been a number of social media accounts getting hacked over the past year. Just 2 months ago, my Quora account was also potentially hacked (it took the powers that be 4 days to tell us) as well.

MNHQ
NellMumsnet · 07/02/2019 14:32

Just to clarify my message above, on the app you can view threads without being logged in, but you shouldn't be able to load the list of threads I'm watching. Apologies for the lack of clarity.

This does mean that you may not know that you have been logged out. Hitting "reply" or clicking the menu at the top right will help you check your status.

TheFuckfaceWhisperer · 07/02/2019 14:28

I’m just using the mobile website (not app) on iPod touch and Samsung Galaxy, one using Safari, one Chrome

DonDrapersOldFashioned · 07/02/2019 14:28

I’m trying to email HQ on [email protected] but it keeps getting bounced back as spam. Hmm

TheFuckfaceWhisperer · 07/02/2019 14:26

Every time I’ve gone away from here for an hour or two I’ve had to log back in again and I’m usually always logged in. Four times so far today. Also with the Facebook/Google/email log in options