Active discussions

Meet the Other Phone. A phone that grows with your child.

Meet the Other Phone.
A phone that grows with your child.

Buy now

Please or to access all these features

Talk
Chat

Join the discussion and chat with other Mumsnetters about everyday life, relationships and parenting.

Original poster

Another Mumsnet data breach

90 replies

kittensinthekitchen · 06/06/2022 23:46

www.mumsnet.com/talk/site_stuff/4564026-change-in-format-of-response-to-report-emails

A user posted in Site Stuff earlier today to say that they'd received a response to a report they'd made, then noticed it included the other user's name and email address.

Justine has said the following

We had a temporary glitch with 'Report this post' for a short time today which meant the email of the person reported was included in the report and in a few cases in responses to those reports. This applies to a very small number of users and we'll be contacting them shortly to let them know. Our DPO has been informed and on his advice we'll report it the ICO if appropriate. Please be assured the issue is now fixed. We will of course be examining how it happened to ensure it never happens again. We're really sorry for any concern caused.
**

Has anyone been contacted? If you've noticed you've had a comment deleted today, beware, the person who reported it might have access to your personal information.

OP posts:
Imthedamnfoolwhoshothim · 06/06/2022 23:50

Will MN be making those affected know?

Would those who have the emails email the other emails to alert them?

Skinnermarink · 06/06/2022 23:51

God, what a joke.

apparently new sign ups have been suspended too.

kitchens4ever · 06/06/2022 23:53

That is so awful. Really sorry for anyone affected. It is very concerning.

Hugasauras · 06/06/2022 23:53

This was the nudge I needed to change my MN email address to a random burner one! Not good.

TreadingWaters · 06/06/2022 23:53

This is really bloody serious.

MNHQ might let the ICO know? Might?

GCAcademic · 06/06/2022 23:55

As this is not the first data breach on this site, I strongly recommend that anyone who does not want their identity revealed have a separate email account for MN, with an email address that is not identifiable.

worraliberty · 06/06/2022 23:58

Skinnermarink · 06/06/2022 23:51

God, what a joke.

apparently new sign ups have been suspended too.

That's probably due to a really persistent troll that's been hanging about for the last couple of days.

Skinnermarink · 07/06/2022 00:06

worraliberty · 06/06/2022 23:58

That's probably due to a really persistent troll that's been hanging about for the last couple of days.

Show quote history

Ah right yeah, I thought they had IP info or similar to identify PBP but maybe there’s been a breakdown in that.

Rainbowshine · 07/06/2022 00:07

I reported a post earlier and on the reply it contained the details of the op, which was clearly a spam type email address but it’s worrying that if someone was say, asking for help to leave an abusive relationship and the person who they are leaving reported the thread, it would potentially create a threatening situation for the OP.

Original poster
kittensinthekitchen · 07/06/2022 00:09

Skinnermarink · 07/06/2022 00:06

Ah right yeah, I thought they had IP info or similar to identify PBP but maybe there’s been a breakdown in that.

Show quote history

I've read somewhere that PBPs have been able to reregister on the new platform, as if any banned IPs, emails etc haven't carried over.

OP posts:
Original poster
kittensinthekitchen · 07/06/2022 00:11

Rainbowshine · 07/06/2022 00:07

I reported a post earlier and on the reply it contained the details of the op, which was clearly a spam type email address but it’s worrying that if someone was say, asking for help to leave an abusive relationship and the person who they are leaving reported the thread, it would potentially create a threatening situation for the OP.

Yep, people report threads for all sorts of reasons, not just trolls, so anyone could have anyone's contact details.

No-one from MN seems to be available just now to answer people's questions over this, so it seems they're not seeing it as a big deal at all. (Though someone did say they now have an identifying email address for a member of MN admin, so maybe that will be taken seriously)

OP posts:
PinkScrunchie · 07/06/2022 00:17

If there is a data breach then I would like to know about it. You’d think by now after all the other data breaches this site would be secure.

Jux · 07/06/2022 00:19

I've been using MN less and less due to the new platform which doesn't work for me at all so I have to use the horrible horrible app..... this gives me the excuse I need to take a proper break, and then use a burner address and new nn if I decide to continue, shame as I've been a lurker since 2001 and registered since 2005. End of an era.

Original poster
kittensinthekitchen · 07/06/2022 07:32

PinkScrunchie · 07/06/2022 00:17

If there is a data breach then I would like to know about it. You’d think by now after all the other data breaches this site would be secure.

You'd think they'd be hotter on security by now, but it seems not. I wonder if this will just be swept under the rug again. Makes you wonder how many security breaches happen that they just don't tell users about- it seems this was only mentioned because someone posted about it in Site Stuff. The thread was initially deleted! ☹️

OP posts:
MrsPelligrinoPetrichor · 07/06/2022 07:39

This is worrying!

AuntieStella · 07/06/2022 07:48

Yes, that's worryingly inadequate

I changed to a throw-away email address for MN after Jeffery-gate and discovered only months later that they had retained all users' previous registered email addresses (making change to throwaway in effect useless)

Given the reappearance of old deleted PMs, I am somewhat concerned again about MN standards, and what other old stuff could reappear and where

The best response is to invite in ICO and get their help in putting it right.

Saucery · 07/06/2022 07:49

MNHQ say it ‘only’ affected about 20 users, but is that just the number who notified them that they had the other person’s email address? I don’t really trust MNHQ to give a straight answer about data breaches after past performances tbh.
There might be people who don’t check the email they’ve signed up with so might not know they are part of a GDPR breach at all.

Lonelycrab · 07/06/2022 07:50

Oh shit. This doesn’t sound good. I reported a couple of the troll threads😑

DaisyQuakeJohnson · 07/06/2022 07:54

Because of the nature of this breaching, it makes sense that they don't publicise it to members until they're sure it's fixed. Otherwise all the trolls on here would be reporting people they want to dox.

There are lots of MRAs and TRAs constantly trying to get access to users' details by trying to become staff/admin or trying to hack the system. Everyone should really be aware of that by now. There is a group of 'intersectionists' that lobby for representation on the admin team who are obviously just TRAs.

I started using a MN specific email after the TRA intern breach a few years ago.

Whinge · 07/06/2022 07:54

It's absolutely shocking that there isn't a pinned post or main notification about this. Just a message on a thread, which many people won't read. Shock

Saucery · 07/06/2022 07:58

Maybe MNHQ need a Preview button so they can check their emails before they send them out Wink

Original poster
kittensinthekitchen · 07/06/2022 08:01

@DaisyQuakeJohnson

They say it's been fixed already, thankfully.

I did ask Justine last night what time period it affected but it seems a fairly serious data breach isn't a reason to ensure staff are available for any questions 😕

OP posts:
CaptSkippy · 07/06/2022 08:06

I recommend using a separate email account for sites like these. I realize that a data breach can come from any organization, but in this case we want to remain anonymous.

Onionpatch · 07/06/2022 08:09

I reported one of my own posts as I decided that whilst true for me, it might have prevented somone in a domestic violence situation leaving, anyway, the responese does contain my email address in the text (never has before)

The email was at 5.27 on Sat 4th for anyone wanting the time.

Its not a data breach for me as its my own data - but MN havent said anything and its only luck it was my own post i reported.

Moosake · 07/06/2022 08:11

Do they send you an email if you get reported? How will I know? I'm shocked at this tbh.

Swipe left for the next trending thread