Active discussions

Meet the Other Phone. Child-safe in minutes.

Meet the Other Phone.
Child-safe in minutes.

Buy now

Please or to access all these features

Talk
Site stuff

Join our Innovation Panel to try new features early and help make Mumsnet better.

See all MNHQ comments on this thread

MNHQ

Mumsnet data breach - please read

868 replies

JustineMumsnet · 07/02/2019 12:40

As some of you know, we're very sorry to say that we’ve become aware of a data breach which affected some Mumsnet user accounts

What happened?
There was a problem affecting Mumsnet user logins between 2pm of Tuesday 5 February and 9am on Thursday 7 February 2019. During this time, it appears that a user logging into their account at the same time as another user logged in, could have had their account info switched.

Why has this happened?
We believe that a software change, as part of moving our services to the cloud, that was put in place on Tuesday pm was the cause of this issue. We reversed that change this morning. Since then there have been no further incidents.

How did Mumsnet find out this was happening?
Late last night, a Mumsnet user alerted us to the fact that they were able to log in to and view the details of another user’s account.

What information could have been affected?
If someone other than you logs into your account, they can see:
your email address
your account details
your posting history
your personal messages

They would NOT have been able to see your password because that data is encrypted and they would not have been able to change your password because you need to input a password to do that.

How many people are affected?
At the moment, we don’t know for sure but we are investigating the logs and hope to know definitively very soon. We do know that approximately 4000 user accounts were logged into in the period in question but we don’t as yet know which of those were actually breached (ie also affected by a mismatched login), although we know for sure it wasn’t every account. We have been made aware by users of 14 incidents when this occurred and have contacted the individuals that we know were affected. We are working hard to establish if there were more.

What have you done about it so far?
We’ve reversed the software change that was made on Tuesday pm, and this morning we forced a log out, requiring users to log in again before they can post. This ensures that anyone who had inadvertently logged in as someone else will no longer be logged in to the wrong account.

Where can I get updates?
We’re posting about the situation on this thread, and will update as and when we have further relevant info.

What happens next?
When we have any further substantial information affecting the security of Mumsnet user accounts we will send another email and post on the site.

We’re very sorry.
You’ve every right to expect your Mumsnet account to be secure and private. We are working urgently to discover exactly how this breach happened and to learn and improve our processes. We will also keep you informed about what is happening. We know some of you will be very worried by the possibility that your account has been breached - please mail us on [email protected] if you’d like to discuss your individual account details. We will of course be reporting this incident to the Information Commissioner.

Thanks to all who brought this to our attention.

Justine

OP posts:
Thread gallery
5
AlexaAmbidextra · 08/02/2019 07:42

I just checked my iCloud Keychain and have the same thing - three usernames stored that I've never used.

Me too. I’ve just found a slightly incorrect user name (one letter different) with a bizarre password that I would have never thought up. How very alarming.

AlexaAmbidextra · 08/02/2019 07:46

a few posters are cosying up to ‘Justinemumsnet’ as though she’s a personal mate who’s just having a hard day juggling being a mum and running a business.

Yes. Vomit inducing isn’t it? 🤮

GrumpyOldMare · 08/02/2019 07:49

We sent a mail out to every email on our database about the breach

@JustineMumsnet I haven't received any email

WhatTheNightBrings · 08/02/2019 07:49

okokokok and I'm sure there was another poster too...

You should have received emails. All this "oh we only contacted the users who had someone log in as them, not the users who could log in as someone else" is bollocks. The above statement says that accounts logged into at the same time were switched ergo if you were logged in as another user, they were logged in as you.
Either MN don't actually have a clue what happened and are making it up as they go, or they are deliberately trying to minimise the effects by saying "only 14/15 Users are affected" by not counting anyone who actually made them aware, only counting and notifying those who haven't contacted them first.

IceRebel · 08/02/2019 07:54

Exactly WhatTheNightBrings, the OP says

During this time, it appears that a user logging into their account at the same time as another user logged in, could have had their account info switched.

So surely all posters affected should have been contacted, not just those who were "breached." As posters who logged in to a different account will have had someone else in their actual account.

barefaced · 08/02/2019 07:54

I was logged out of the app a few days ago, didn't bother logging back in until I just read about the breach. Password wouldn't work so had to reset.

WhatTheNightBrings · 08/02/2019 07:54

Also, when you ran your Christmas appeal, and were challenged over your lack of advertising it, you seemed to say that Twitter was your main source of regularly posting about it.
The fact that you haven't even mentioned this on your Twitter account further suggests trying to bury this further from public knowledge.

HaudYerWheeshtYaWeeBellend · 08/02/2019 07:55

I dont think they are cosying up to her, Hmm they can get their concerns addressed without mass outrage,

They can also have empathy for quite frankly what is a very stressful situation.

My own organisation had a bug last year in which data could have been breached however we managed to stop it before it happened just by the skin of our teeth, it was stressful for all concerned, and we have to remember these words on a screen are being red by another human being!

HarrysPoorFoot · 08/02/2019 07:55

I've also got usernames I'm pretty sure I've never used in my account. :(

I don't get enough benefit from Mumsnet to deal with the grief it causes. Not just this breach but some of the people. I'm not having a strop or a big announcement that I'm going but just wanted MN to know why I've closed my account.

WhatTheNightBrings · 08/02/2019 07:57

9 hours radio silence on this. It's like a kid who never learns from their mistakes.

Mumsnet, yes the fuck up is done and can't be turned back, but ffs communicate with your users. Isn't it clear that would be the best way to limit further damage right now?

I would seriously put money on there being no additional staffing overnight last night.

Nicknacky · 08/02/2019 08:07

non I disgust you? Slight over reaction there.

My point is, their security has been breached by their shoddy systems, not by a sophisticated hack that is out with their control.

Cbatothinkofaname · 08/02/2019 08:20

Those who are trying to minimise this, or accuse those who are angry of being hysterical sound dangerously close to victim- blaming. And the victims here are the users- not MN. This is their balls up.

FWIW I don’t think my data was breached this time (though who knows?)
Also after the last debacle I created a new email account and passwords used only for MN. However I would never dream of criticising someone who uses their regular email account, or suggesting that users are not being responsible enough - ffs stop victim blaming. MN is a fucking big business (well- at the moment Grin) It wouldn’t bring in the revenue it does without its users and they have a right for their data to be safe.

Pushpull · 08/02/2019 08:26

I really think someone should have been here overnight addressing questions. It's still very unclear whether everyone whose account has been compromised has been contacted, originally there was mention of 4000 accounts. Why can't mumsnet be clear on
A. Has everyone whose account has been breached received a pm.
B. Do you actually know which accounts have been breached - which to be very clear means someone can connect your history of posting (including any name changes) to your email address.

I don't think anyone needs to be rude but let's be clear, mumsnet is a big money maker, it's not cutting slack to the lady who runs your local toddler group, and we are entitled to be concerned. I'm not sure jokes about having a gin from the founder are the way to go here.

To be clear I don't necessarily think Justine should personally be here, but the questions should be being answered appropriately and in a timely way. From what some posters are saying it's far from sorted

Olgatheoptimist · 08/02/2019 08:37

I was logged out last yesterday. Bo email. Going to close account.

Gillway · 08/02/2019 08:42

I don't trust anywhere on the internet with my personal details so I take precautions.

justasking111 · 08/02/2019 08:44

I could not get in set up a new account. Can now get in on phone but not laptop still after putting in password it will not go any further weird

justasking111 · 08/02/2019 08:45

Sorry can get into old account on phone not laptop.

beanaseireann · 08/02/2019 08:45

Will Mumsnet contact you directly by email and state clearly your account has been hacked or will they just send a generic email saying that some Mumsnetters may have been hacked?

Xenia · 08/02/2019 08:51

There hasn't been a hack as far as I know. However it sounds like some people had access to other people's emails. Taht may not matter if it said meet you for a drink at starbucks but it might if it were the whole history of your divorce or legal problems. I have just about no emails on MN so not an issue for me but I can see that for some people it could be a big worry.

IceRebel · 08/02/2019 08:58

However it sounds like some people had access to other people's emails.

No some posters had access to

your email address
your account details
your posting history
your personal messages

Having your email address is pretty shit, but being able to access personal messages is even more worrying. As some had already said on this thread there may be addresses, and other more outing information in personal messages. Which could put users security at risk if it was to end up in malicious hands.

Xenia · 08/02/2019 09:02

Yes,, I know. I mentioned emails as that seemed the worst. Posting history you can search on the stie for. My email address probably people use an anonymous one. Account details could be a bit dull but the personal email messages sounded like the worst bit - Jane might have written to Mary about her fears her husband is abusing their child and doesn't want that spread around etc.

(Actually your point illustrates why English is so important. People have starting referring to someone's "email" as meaning their "email address" which I would never do. I would say access to email addresses. Sloppy Enghlish is using access to emails to mean access only to email addresses. The email is the personal message. I suppose it illustrates why we need to fight the good fight every day to stop people using the word email to mean email address when it means the email - the text of it - itself.)

MarshaBradyo · 08/02/2019 09:02

The trouble is the vague language and approach doesn’t reassure me completely that everyone has been contacted

MNHQ are you 100% certain everyone who has been breached knows?

Olgatheoptimist · 08/02/2019 09:03

Just tried to dereg. Clicked on link 3 times. Page crashes

MarshaBradyo · 08/02/2019 09:03

I also think this site has moved on from cosy have a gin messages

JaneJeffer · 08/02/2019 09:05

Sloppy Enghlish oops Grin