Mumsnet data breach - please read

www.theguardian.com/uk-news/2019/feb/07/mumsnet-reports-itself-to-regulator-over-data-breach

I think this has been handled relatively well. Quick action was taken, we’ve been kept up to date, it’s not malicious.

The issue was first flagged up in Site Stuff on Wednesday evening, and Mumsnet didn’t start actually addressing it until the following morning, so it took them about 9 hours, and in the meantime the problem was presumably continuing. That’s not quick.

I doubt very much that Mumsnet is legally responsible for an accidental security breach Of course they are. It's called negligence. GDPR has strengthened consumer protection and compensation is payable where loss occurs. The ICO can fine etc but individuals can also pursue their own claims.

Sinister I reported those posts. Suggest you do as well. Not on, imo

I notice that a poster on here is trying to prove their point about internet security by posting details about another poster (who disagreed with them) Mumsnet history. Is this now acceptable?

I doubt very much that Mumsnet is legally responsible for an accidental security breach.

Are we giving out Darwin Awards this week?

As far as I'm aware, no one pays to use MN

Of course you do. Not in cash terms but by posting and engaging here you are the product.

As far as I'm aware, no one pays to use MN

Not directly, no - although I suspect we'll be asked to, if this current mess means employing better IT staff

As PPs have said, though, users are in effect the product. They keep the site busy enough to enable MN to sell advertising, entire threads and whatever else, so it's their very use of the site that enables the company's profits

Ive just logged in on the app and then changed my password on the desktop version and gone back in via the app and haven't been asked to rekey my password. As other PP have said shouldn't this have triggered a relogin page?

I think this has been handled relatively well. Quick action was taken, we’ve been kept up to date, it’s not malicious.

When you think how long it takes email providers yahoo to notify you if they ever do this response seems proportional.

Okay, yes. Mumsnet should have a legal responsibility to keep our personal information private. But as to what we choose to post in public, even under an assumed name, that should be our responsibility. Either we take an informed risk or we don't post at all. That's always been my understanding, anyway.

What tit said.

@MNHQ
I still not have received an email from you.
Please Can you tell me if my data has been breached?
Thanks.

Anyone interested in their privacy rights by the way may want to do what I did recent which is opt out of the new NHS database. I had to do it by post as they did not have a mobile number or email address for me on record and I was not happy to give them one digital.nhs.uk/services/national-data-opt-out-programme

If you are then I'm afraid you really do not understand the situation.

@RedToothBrush - maybe it is YOU that does not understand the situation. My point was to excuse MN from doing any replying to individual concerns for 9 hours (just because that is when most people are asleep) is not acceptable. I am not one of those affected. I do however have sympathy with anyone who is now worrying about their personal information being compromised

Someone has just posted this on reddit. Is this true MN?'

It was posted on this thread actually.

I doubt very much that Mumsnet is legally responsible for an accidental security breach

I said they have a legal responsibility to protect our data. They also may be fined for this breach. The ICO will decide on how negligent they think mumsnet have been. Companies can't just say 'oopsy it was a mistake'.

I think the underlying issue is that MN does not have the IT support that a business with a million users and a turnover of around £8m should have. Thorough software testing is vital but is often seen as an area where savings can be made because cutting corners on certain areas of testing is a low risk/high impact scenario. Unfortunately this is one of those times that the unlikely outcome did happen and now we have thousands of users feeling the impact, even if the majority is lost confidence rather than actual harm.

If MN is to keep its greatest asset - its membership - then it needs to start investing in a proper IT service; one run on ITIL principles, with the knowledge and skill to both manage risk and communicate with users appropriately; adequately staffed to provide 24/7 cover when serious incidents occur; and basically shit hot at their job and their knowledge of emerging technologies. Otherwise, we're simply going to leave in droves because we don't feel safe here.

Yes, it's good practice to register for websites with one-time-only email addresses (something I already do), yes, breaches can happen anywhere because hacking is big business and yes, I have sympathy for stress caused to the humans involved in having to fix this as much as those affected. But this wasn't a hack - this was a failure of software management. And every time a problem occurs here, it's dealt with amateurishly: half-understood information passed on then backtracked, gaps in communication, conflicting messages etc etc. It's not good enough really, is it?

As far as I'm aware, no one pays to use MN. Why do they "owe" us anything? They do their best but there's always going to be a security risk. It's naïve to believe otherwise. You share your privacy at your own risk.

Facebook is free too.
They all have a responsibility to protect our data.
Doing anything online carries a data-breach risk, but that doesn't absolve the provider from having the best security they can.

All of this has happened with the new log-in procedure when they fiddled with it earlier in the week.

There are often teccie issues with MN.

I assume it's because they are not willing to pay for the best software people out there.

Mnhq are woeful in this regard. Completely out of sync with good standards

It’d be a point if they actually got close to the things listed

I doubt very much that Mumsnet is legally responsible for an accidental security breach.

Get real, kittykat! That's impossible to guarantee.

Any account, be it bank, health records, Facebook, MN, whatever that is on the Internet can potentially be hacked. There is no such thing as guaranteed privacy or security on the Internet.

This.

Unfortunately.

I think we will see a massive healthcare data breech at some point. As it is many people have had their medical history 'sold' without their consent.

I do think there is a lack of awareness in data and what can be used, abused and leaked.

People need to take an on balance approach to data security. What do you get from MN is it worth it? For many vulnerable people if there is no where else to go for help, then yeah it's valuable.

I don't know. I'm angry about this, but far less concerned than a leak with malicious intent. My concern going forward relates more to MNs lack of understanding of security and it issues and how that leaves them exposed to future malicious leaks. They need to do better and take security more seriously.

As far as I'm aware, no one pays to use MN. Why do they "owe" us anything? They do their best but there's always going to be a security risk. It's naïve to believe otherwise. You share your privacy at your own risk.

They 'owe' us because they have a legal responsibility to protect their users data. What has paying to use mumsnet got to do with anything? Do you think mumsnet run this website out of the kindness of their hearts? They're raking in money from advertisers and tabloids and the only reason they are able to make this money is due to their users.

'Someone has just posted this on reddit. Is this true MN?'

Maybe they'd be better off posting it here? It's a stretch to ask mnhq to answer queries from another site .