My data has been breached

Funny, there's been no response from MNHQ yet?

This is serious, pretty concerning but no updates for 10 days?

I don’t think they were fixing that, although it would seem it’s neither necessary nor good practice to include the Reporter email in the reply to the Reporter, so maybe they should remove that inclusion.

If you report something the email you get in response shows your email address. I thought this was being fixed?

Not suggesting the poster was a troll btw, but troll hunting is just one example (along with reports about breaches to MN guidelines etc, which seems to be the case here), of what the Report feature is used for.

MNHQ are constantly telling MNers to report, report, report never troll hunt, don't discuss misgivings on the actual thread, etc. Well this is a sure-fire way of putting people off wanting to use the Report function if ever I saw one. It's always with the benefit of hindsight that these "glitches" (aka human cock-ups) come to light, when it's too late. The mess may get cleared up but the reputational harm remains. Trust is very very hard to earn, and very easy to lose. People are still talking about the Jeffrey-gate hack years after the event and now Report-gate.

I've been saying from the start (pre-go live) that the lack of controlled end-user testing is a shocking and highly risky strategy when you're talking about a public (and highly visible) platform like this. Asking MNers to "test some stuff" when they are not paid to do that and not qualified (good testing is a very skilled profession), is poor practice. Testing isn't only about "does it work", it's also about picking up risk areas that the untrained eye may not even realise is a problem. If I was the head of MN no way would I give such an important part of a new platform launch to unpaid, untrained, unqualified (no offence meant but it is a fact) "testers" who don't have skin in the game in MNHQ and won't be called to account if the law is broken in plain sight.

It's through controlled testing that you get to know of, document and mitigate potential security holes (in this case, that can be caused by procedural human error). If this platform software is a US product, they don't know the meaning of GDPR now DPA2018, Europe and U.K. are leaders in ensuring people's privacy is maintained by law, so it can be missed during the development cycle of this platform in a country that doesn't value data privacy, and that gap has to be plugged by human intervention (ie procedure/documented work practices, which HQ now admits was missed. I always have the perception they're "winging it" and perception can be 9/10th of reality!

Has anyone had a satisfactory response yet from @MNHQ on any of the questions or points from this?

I'm beginning to feel (just slightly) concerned that Boris has had @JustineMumsnet taken out of action after her scathing interview.

I still get emails from MN to the old email address that they supposedly deleted (after Jeffreygate I asked them to delete my account and posts and created a new acc with a burner email).

Why would they have a grudge?

(that you know of)

Sorry I should have made that clearer.

Contact systems are normally configured so that neither the customer manager nor the customer has direct sight of email addresses or any direct contact info.

So if unneeded contact information appears in the body of a mail this is nearly always badly configured software or someone not following data privacy policies. I'm assuming this is what happened in the case of the exposed OP and moderator addresses, that has been accepted as wrong. However I also saw my address as a reporter flagged up in the mail which was a different format to old responses. That exposes my address as a reporter to both the mod responding and anyone looking at the reporting system. That shouldn't happen either.

Its shockingly bad software management that someone could bypass process in two places to create a breach. Its also shockingly bad data and privacy management, especially after the previous breaches which have included malicious actors from inside the business.

MN absolutely assured everyone, some time after Jeffery-gate, that old email addresses had been permanently deleted if users updated to a new address, as they put forward no business reason for retaining then.

I changed addresses then, and will be absolutely furious if

a) retained anywhere my old email address, and therefore

b) have reneged on their assurances that they were deleting all old eaddresses.

And b is the reason for the furious response. If that had happened it would clearly indicate untrustworthiness, and a bad attitude to their community (tell 'em one thing, do another - they're not worth straight dealing)

I think the ICO needs to take a good hard look at these issues for everyone’s sakes.

And MNHQ should hire a data protection professional to do a thorough investigation.

(I still find it hard to believe a single staff member was able somehow to ‘add in’ posters’ email addresses accidentally.)

I am still in touch with a Mumsnetter who was banned last year. She suddenly started getting automatic emails about a year after she was banned,. They were notifications of threads she had been watching.

Maybe it was part of the weird time-machine thing where deleted PMs from years ago have been suddenly reappearing in Inboxes?

I assume that when an account is banned and closed by Mumsnet that the email address is retained in order to identify ex-members who rejoin after being banned? However, Mumsnet should not be spamming ex-members with "Watch Notifications". Rubbing salt into the wound if the member has been banned.

It makes me wonder if Mumsnet retains account details if someone has closed their account voluntarily?

C8H10N4O2 - Apologies if I have become confused by the issues mentioned in this thread.

Has Mumsnet said that "reporter" email addresses have been exposed to the person reported, ie. as well as the "reporter" being sent the email address of the person they have reported in "about 20 cases"?

There’s a ten-page thread about it. It’s hardly been ignored.

Are we just ignoring this all in the hope that it will cease to have happened?

And also that reporters' own email addresses being exposed in replies is being fixed.

There is absolutely no reason to expose reporters' email addresses in replies, any half way thought through contact system should be masking contact details for customer/reporter, respondent/moderator and any third parties so that nobody in the conversation has personal details exposed.

This new system has exposed all three when all three should be concealed.

Hi @MNHQ @JustineMumsnet

Are you able to confirm the number of people affected by this yet?

So they probably don't delete them properly, fortunately the only proper email I have ever used is an old defunct Tesco one, I have never wanted to use the same one for stuff like MN and Twitter as banking and important stuff.

I never signed up for emails but I started getting them to an old address "deleted" years ago when they launched the fewer ads Mumsnet premium

I can't remember if I still got the marketing emails after I deleted my account, I certainly got them when I changed email

Email addresses seem to be there if you change it but that may be if you are signed up for emails because when I changed my email I still got emails to my old email because of this, it must be a separate bit so you also need to go in and delete all notifications like newsletter and mumsnet offers. When you delete your account there is a list of things MN get rid of so one would hope that is right. Apples hide my email is quite useful to use if you have Apple.

They don't delete it as I've had emails from them after accounts were "deleted".

Do they though?

It's already been shown that they retain old email addresses (or have done in the past anyway, with no satisfactory explanation), so who can actually be sure?