My data has been breached

@JustineMumsnet, for the love of God, please stop posting. You look more unprofessional and passive aggressive with every comment.

It doesn't matter if the OP is Hitler reincarnated. As a user of the site, s/he is entitled to the same data protection as the reincarnation of Mother Theresa. Reposting deleted comments when there are other ways of reassuring site users that there was no malicious intent and of contacting the OP is snide, immature and gobsmackingly unprofessional. This isn't the twee 'round the kitchen table' amateur operation any more, it's a multi-million pound business and as the CEO, you're damaging your brand by acting like an aggrieved sixth-former when the fact is it's YOUR IT fuck-up (again!) that has potentially placed users of your site at risk.

At the very least you should replace the post in which you quote the OP's comments with the "message deleted - quotes deleted post" standard MN moderation message while you concentrate on putting in place the necessary measures to minimise the chance of this happening again. I recommend a thorough overhaul of your database structure and employing some system testers who know what they're doing.

My mistake. Reported posts not deleted ones. Sorry.

Lots of banks have data breaches from wrong addresses on envelopes, to leaving laptops on public transport etc.

Any organisations can have data breaches, so care is needed before signing up, but once the data is transferred it is out of your control. People need to understand that using the same ID to access your sensitive personal data eg your bank account while publishing personal data across multiple sites which can be collated is in itself a security risk.

People should work on the assumption that their data will be subject to a data breach at some stage.

I agree. If you don't care use your real name as your user name.
Except virtually no one does. Which shows they do care about privacy here.

Wait, what? I thought it was the deletion that triggered the inappropriate disclosure of the poster's email, that just a reported post was not involved. OMG.

Will have to go back through the threads and clarify, I expect I am misremembering.

@SlatsandFlaps Nothing to hide?
So you don't care that someone who has an axe to grind against you knows how you have struggled with your 7 year old who is still wetting the bed? Or that they can link to your real-life 10 year old and read all about the bullying they experienced? Or comments where you think you messed up in your parenting?
Or comments about how shitty your sister was to you when you were breastfeeding?
I have discussed normal parenting issues on this site. But they are absolutely private and I would NEVER have talked about them if I was identifiable. My children do not need other people to know identifiable information about them. That would be humiliating and distressing for them.
MN is useless as a parenting site if privacy is not guaranteed. If all you are going to talk about are toilet brushes and TV stars then it is just a gossip site for bored housewives and I would never have joined in the first place.

Agreed. Justine's comments have been really unprofessional.

I don't believe the 20 people. I know three people including me affected by this.

It's not about 'having nothing to hide'. If someone who took a warped dislike to you for any reason decided to dig, putting together information about you from your email address, your MN posts and any other information they could glean from your online footprint, before long you could find yourself answering the door to pizza deliveries at 1.00am, having the police called to your house on spurious reports of someone having seen a firearm...whatever their twisted mind could think of to make life as difficult as possible for you, And the fact you lived a blameless life wouldn't make a gnat's ass of a difference to them.

Can you really not understand how an email address - especially an email address that immediately links someone to what could be a series of revealing posts about their life, their problems, maybe their location - is a piece of the jigsaw these people use to disrupt their targeted victims? Why do you think data protection is taken so seriously and there are sanctions for breaching personal data, which includes email addresses?

@AuntieStella I agree with you. My comments were not deleted. I have never had a comment deleted. You can still get comments reported, especially if you are talking about a controversial subject on feminism or politics. Some people report just because they do not like what you said. Those people now have my identifiable email address.

Thanks. It is so awful. I can't believe that this has happened.

And what makes it worse is unlike other social media sites, we have no control, over our comments. So GDPR matters more on MN than other social media sites. I can just delete or edit my comments elsewhere. Here people have to contact MN and ask them to delete or change things.

(Who you choose to believe is of course, your choice.)

Wow. I'm hazarding a guess that you don't have a PR person looking over your responses before you press send, @JustineMumsnet
That kind of passive aggressiveness is really bad look, however frustrating it must be to be dealing with this.

@Userforever If this was a tiny forum I would agree. But why are people stupid if they think they can trust MN to adhere to a very basic level of GDPR?
I do not understand why this issue was not identified in the initial testing of the new site. How can they not have known that someone's personal email address was being sent to anyone who reported a comment? It is beyond belief.

You think I was stupid to trust MN not to make this very basic mistake. I think anyone should be able to trust a site of this size not to do this. It really is amateur hour.

And people are trusting MN with their financial information by signing up for premium. Are they also stupid?

I do not know why anyone would want to remain here when such a basic mistake can be made. This isn't a hack which I know firms have suffered and that has led to GDPR breaches. This is a very basic programming error and a total lack of basic testing.

Notstaying I am so sorry, mate. I hope as you do, that there are no RL consequences from this event for you.

I am one of the posters affected. I have deregistered but have temporarily joined with a disposable email address to comment on this thread. I have no intention of staying.
All those people who say who cares? I am identifiable from my email address. I stupidly trusted Mumsnet. It is a big site, not a tiny local one and I assumed that my email address would not be shared with anyone else.
You might not care. But I have no idea who has my email address and what comments they can link them to. I think I know the thread where my comments would have been reported. It could have consequences for me in real life depending on who reported my comments.
It is easy to underplay this when you are not the one affected. But now I am left in the position of simply having to wait and hoping I have no problems in my life as a result of this data breach.

Perhaps MN needs to clearly state that when new users register, explaining that previous data breaches have occurred.

And have that prominently displayed somewhere on the site.

Something like this has never happened with my bank. How could it? I don’t report other customers.

Mumsnet are once again showing everyone how incompetent they are.

Exactly this. I totally understand mistakes can happen, but the way mumsnet has handled the breach (again) has been awful.

@JustineMumsnet

Can you clarify if those comments you've posted were made by @Simbaya or another user/username?
Have you just publicly called out a user who had changed their username? Was it a name change, or a different account?

Seems majorly off to post the posts in this thread when apparently mnhq wouldn't email them to poster.

Mnhq always seem annoyed at posters when a data breach happens or similar and people are angry. Which is a weird vibe to put out when it's their mistake.

Email can be a scary thing for a forum where people post so much info, with an email address and being able to trawl back posts for talk of location or jobs etc probably quite easy to pinpoint a lot of people without even getting into what if the type of posts you make are ones that are regularly targeted (feminist board)

I agree its wholly inappropriate. Privacy rules are not just there to protect "people like us" whilst exposing the plebs.

It reflects really badly and doesn't inspire confidence or trust in data protection or even an understanding of data protection.

We are constantly asked to report trolls and not challenge them on threads. How likely are people to use the reporting system knowing that their own email address is exposed every time as the reporter and that random individuals can override deployment processes and implement something like this without checks or supervision?

Unfortunately, I think you are making good points.

Also you get emails even if they're 'just going to look now'

Did those contain the breach too?

You might never know if you've been reported, if it didn't lead to a deletion. But there would still have been an email about you to the one who did the reporting

@Simbaya

I’m appalled that Justine repeated your posts in public. I don’t care what was in them: Without context many posts can look needlessly aggressive and nasty. But doesn’t retract from our fundamental rights to have our data protected without resorting to special email addresses- do you think people of Reddit have to think about this stuff?

AND sorry Justine, it makes you look passive aggressive, unhinged and quite vindictive. You gonna drag up some of my posts now in retaliation for not being kind?

You’re holding access to all our data and I’m not sure if I trust you lot with any more of my own. You are bad at handling the data AND bad at handling breaches. Your optics don’t look great.