Hi everyone and thanks for your questions - we're very happy to update you on the changes we made.
As soon as we became aware of the data breach we removed IP addresses from the admin view of the site. They're now only visible to a restricted number of vetted moderation staff who need to access users' registration data and IP addresses to reduce troll activity, and to a small number of senior team members. We monitor all permissions and regularly review them.
We also looked very carefully at our entire approach to data in response to this incident, and as part of our preparations for GDPR. We put in place a number of measures to make sure that we go above and beyond what's required to keep your data safe - and if you're at all concerned, we've made it very easy to find out which personally identifying information you've given us, and to change or delete some or all of that data. You can find out about that over here.
Just to reassure you again, it's extremely unlikely that anyone could be identified by an IP address alone, and no-one was 'doxxed' as a result of this breach. As Justine said at the time, we're as sure as we possibly can be that the tweeting of three posters' IP addresses was genuinely unintentional, and that the aim was to draw attention to the content of the posts, not to reveal identifiers.
We did make the police aware, just as a precautionary measure; we haven't had any further communication from them so we believe they were satisfied that the IP addresses had been revealed inadvertently. As someone has mentioned we also reported ourselves to the ICO, and they were satisfied that we'd responded effectively to the incident and closed the case.
Hope that's clear - please do shout if you have any further queries.