On Feb 5, 2019, a data leak was reported and a Stack Overflow Product Manager admitted to causing it.

We got an "oops, sorry, won't happen again". For some, this is not enough, considering it's not the first data leak caused by sloppiness on handling personal information.

As I can not see any update than the initial "oops", my question is: what has Stack Overflow done to fix this data leak (e.g., contacting Amazon, contacting the affected users, reporting the data leak to authorities, or anything relevant), and what are the steps that are being taken internally to avoid very serious "oops" situations in the future?

I will use "leak" instead of "breach" to prevent people from focussing on technicalities instead of the actual question.

To be clear, I understand these things take time. I'd be happy to get a "we are looking at this, and we will make a update explaining everything". A promise of a future answer is better than nothing.

  • 80
    What quiet lives sites without a "meta-site" must live. – yivi Feb 18 '19 at 11:26
  • 40
    @yivi lives with unreported data breaches, definitely :D What happened was both illegal and caused by laziness, I feel that we deserve a bit more than an "oops". – Ander Biguri Feb 18 '19 at 11:27
  • 20
    I don't think "what happened was illegal" is commonly accepted, nor the fact that this was a data breach. – Magisch Feb 18 '19 at 11:56
  • 24
    @Magisch IANAL, so maybe data breach is not the right word. It being illegal in the EU is quite straightforward, GDPR and such. However I avoided using the illegal word in the question for some reason. If you have a better description than data breach, please fell free to edit the question. ("Enormous fuck-up caused by laziness" sounded worse than "data breach", so I kept the later) – Ander Biguri Feb 18 '19 at 11:57
  • 34
    @AnderBiguri Since you started the GDPR discussion, In my (semi professional, non lawyer) opinion, Stack could reasonably rely on justifying the processing under Art 6. b) "necessary for the completion of a contract between the two parties" wrt. a consideration of the interests. Honestly, not knowing anything else about the process, I wouldn't call this a data breach or illegal, I'd call it unfortunate at best. – Magisch Feb 18 '19 at 12:05
  • 6
    @Magisch fair, but without all the legalese, it suck that they did this and I am disappointed that it happened, and double disappointed with the response they gave. IANAL nor I want it to be, just an upset user. – Ander Biguri Feb 18 '19 at 12:09
  • 20
    I dislike legal discussions, as the precise facts of the case are important and the only person qualified to give advice is Stack's own counsel, but I also dislike making assumptions like that this is a) a data breach pursuant to GDPR and b) illegal and asserting those as given. – Magisch Feb 18 '19 at 12:12
  • 60
    Not everything that is legal is a good idea, and not everything that is illegal is a bad one. For me as a user of SO, its not relevant if this is a breach that is illegal and is prohibited by law. Whats relevant for my trust in them is how they perceive this breach, how they respond to it, and how they are going to protect my data in the future. Whats important is if my data is protected (or not). Laws and regulations help with that, but is that really the important point right here? – Polygnome Feb 18 '19 at 12:23
  • 7
    @Magisch I don't want to start a discussion on this, but just fyi: "necessary for the completion of a contract between the two parties" is quite clear and doesn't contain any "wrt. a consideration of the interests". At least not from that part you cite. Is it necessary to send the mail-adresses to amazon to complete the contract? No. In my opinion it's reasonable to call this a data breach until someone from SE provides a reasonable explanation why it wouldn't be one. Sure, one could call it "potential data breach" too, but the core point of the question comes across quite well imho. – DonQuiKong Feb 18 '19 at 12:24
  • 9
    @DonQuiKong This is part of the problem with GDPR, what is "necessary" is not clearly defined and highly case dependant. At least in my state in germany, the regulatory agencies have given wide latitude to expediency when it comes to saying something is necessary. Otherwise, under your reasoning, you could argue that using third party payment processors for instance would be unlawful, as businesses could accept payment directly if they wanted and thus the data transfer wouldn't be necessary... – Magisch Feb 18 '19 at 12:34
  • 8
    @Polygnome I agree 100%, this is why there is no mention of legal stuff in the question. I just want to know as a user. – Ander Biguri Feb 18 '19 at 13:04
  • 24
    @Dukeling yeah, "oops, won't happen again". I believe that SO tries to keep higher standards than other companies, and this question is a bit to test that. I need to consider how much personal data I want to have in SO if their answer is not going to be more than "oops". – Ander Biguri Feb 18 '19 at 13:06
  • 43
    @AnderBiguri They have not contacted the affected users, I know since I was one of them. Now overall I don't care much since "luckily?" Amazon already had all my data including my credit card and home address. However I support this request since the community expect SE to be very professional related to this, the usual 6-8 is not good enough. – Petter Friberg Feb 18 '19 at 15:21
  • 25
    On a very serious note, I genuinely do feel like this is a post which is intended to drag this situation through the mud. Again. I do not enjoy this, and while I don't deny that it's serious, not being able to be patient and let the process actually take effect is ridiculous to me. The site hasn't had an opportunity to do this again; that is to say, there hasn't been any giveaways or gift cards distributed for anything new, so anything they'd tell you now would likely be lip service to placate this ire. – Makoto Feb 18 '19 at 18:00
  • 11
    ...so you're not satisfied with Tim Post's answer in the very question thread I linked? – Makoto Feb 18 '19 at 19:31

I'm feeling a whole lot of hate here.

I'm not speaking metaphorically. I honestly feel like you and other people in comments really loathe and hate me. And not just the company, me in particular. That's how I feel, and I can only suggest you think about how vehemently you bang on text boxes going forward; real people with real feelings need to read what you write.

I'll assume the best and just chalk it up to misplaced rage and anger, that's not an environment I thrive in, so this (very) brief answer is going to have to do.

This wasn't a breach. This wasn't a leak. We have a valid business case for sharing your information with a GDPR-compliant third party for fulfillment purposes and this is very well defined in our privacy policy. We screwed up majorly when our actions didn't coincide with your expectations, but sharing your email with a third-party to fulfill a gift card, a shirt, a hat, or a sticker is something that we do any time we send you anything. And we owned that screw up and what it means going forward.

I don't know what else you expect. How did it happen? Anita explained that. I explained it in more depth, and said, well, we're not going to do that again. It was an over-zealous effort on our part to not inconvenience people, there was nothing treacherous here.

If you have any other questions or concerns, you're welcome to email legal@stackoverflow.com.

  • 65
    For whatever this is worth, know that I at least value your time and energy in responding to these statements. I can only imagine how frustrating or tense it must be having to deal with this. Thank you. – Makoto Feb 18 '19 at 19:33
  • 30
    Are you claiming it's was necessary to share the emails with Amazon? Because I know full well that gift cards can be purchased and sent to people without Amazon ever receiving the recipient's email. With that regard, your privacy policy is irrelevant when it comes to GDPR. – jhpratt GOFUNDME RELICENSING Feb 18 '19 at 19:37
  • 29
    Hey Tim, I know there is being a lot of hate towards you, but feel assured that its certainly not coming from my side. Neither have I hate towards Anita or anyone else in SO. I saw quite bad comments in the OP, I do not agree with any personal attack on you or anyone there. My data was not breached so I don't have any personal concerns. I do not think that there was anything treacherous in your actions. Apologies if anything I said suggested any of that. It is not how I feel. I am aware that my wording may sound bad now that I reread, it was not my intention to attack anyone personally. – Ander Biguri Feb 18 '19 at 19:40
  • 38
    Unfortunately, while you see this as a personal issue, I see that a big corporation that has a fair amount of my personal data (you guys have my name, job, location, and for giveaway reasons, my home address too), a genuine apology is not good enough for me. When Facebook apologized (multiple times) no one trusted them, they are a big corporation. You guys (as a corporation) are acting similarly. It may be genuine, but in the world we live in, understand that I do not take at face value anything that a corporation says. – Ander Biguri Feb 18 '19 at 19:43
  • 7
    I particularly like this part of your answer: We screwed up... when our actions didn't coincide with your expectations... Sure, SO can help shape expectations, but we all accepted SO's privacy policy when we created an account. The onus is on the user to understand the Ts & Cs. If a user comes away from agreeing with the Ts & Cs thinking that SO can no-way-no-how-ever-ever-never-fornever share any sort of personal information for any reason whatsoever, then they either didn't read it (likely) or should have sought clarification before agreeing. SO can't fix purposeful ignorance. – Jake Reece Feb 18 '19 at 19:47
  • 12
    @TimPost You realize that for that privacy policy to hold ground you have to detail with whom data is shared in general terms in your privacy policy for it to be valid? A line like "The minimal required data may be shared with Amazon for promotional purposes" Would have helped. Without the line with which third parties data is shared for which purpose in general terms it doesn't hold. lawscot.org.uk/members/business-support/… and I don't feel any hate towards you. I just like things to be done proper. – Tschallacka Feb 18 '19 at 19:48
  • 4
    @AnderBiguri Well, you did write "[...] a genuine apology is not good enough for me." I'm not sure in how many other ways than asking for more that can be understood, but am willing to believe you. – Félix Gagnon-Grenier Feb 18 '19 at 19:52
  • 12
    @FélixGagnon-Grenier a genuine apology is not enough for me to trust that this wont happen again and that my data will be secure in the future. I hope it sounds less "entitled" this way. That is what I meant, sorry if it sounded differently. There is limited space in this tiny boxes. – Ander Biguri Feb 18 '19 at 19:55
  • 9
    That's the thing @FélixGagnon-Grenier the USA and other countries may not have adopted these laws, but any website or company servicing people within the borders of Europe will be subject to these laws and corresponding fines. They can still be fined. If they won't pay those fines those companies may lose access to the European market, or they may be forced to pay the fines due to trade treaties. Will be interesting to see when the first fines will be dealt out and not paid what the repercussions will be. – Tschallacka Feb 18 '19 at 20:09
  • 47
    There's nothing personal to you or Anita, maybe the mods are doing quite a good job but I don't see any personal attacks in the 3 related posts. And now a friendly suggestion, is it possible that it's just because your answer is made inside a less significant post instead of the origin thread that made it less visible, thus caused more questioning? Either way I suggest to calm down and not take it personally. – tweray Feb 18 '19 at 20:52
  • 6
    Tim, based on Anita's answer it sounded like the quickest solution was used. You've said that you're not going to do that again. I think what people here are wanting is to know 'how' employees will be discouraged from using the 'quickest' solution next time, instead of the one that aligns with our expectations (if reasonable). Are you changing internal policy? Training courses? No hate here, I'm just trying to understand your companies processes. – Pureferret Feb 19 '19 at 12:08
  • 18
    I asked a question because I genuinely wanted to know, not to attack personally anyone. By you assuming that I am, you bring this to a different level of discussion, and now reading the comments everything seems to be about Users vs SO, rather than the original question about handling private data. I am somewhat disenchanted by this approach of solving the problem. I don't want to re-start discussion, just convey my final feelings about all this. I honestly appreciate your answer and your work in general. Thank you very much, and keep maintaining SO good, even if in this case we disagree. – Ander Biguri Feb 19 '19 at 12:32
  • 7
    "We didn't intend...subject you to Amazon marketing." Yet you did. It's fair to call that a leak. – Trevor Reid Feb 19 '19 at 12:35
  • 12
    As someone who works in a company in a heavily regulated industry, it's not appropriate to say "it won't happen again". What SPECIFIC steps have you taken to ensure it won't happen again? This could include an official approvals process concerning data going to the outside as one example. Don't take this personally. Getting to a root cause of a problem and finding long term solutions is just a necessary component. – Ctznkane525 Feb 19 '19 at 13:37
  • 13
    Tim, the reason for my downvote on your answer is the same as @AnderBiguri. No where in the question was there any hint at a personal attack; that was something introduced by you on a whim. I would appreciate it if you simply answered the question at hand and nothing more. It is still unclear how much of your statement was approved by counsel, and how much of it was written solely by you. – jhpratt GOFUNDME RELICENSING Feb 20 '19 at 21:53

We got an "oops, sorry, won't happen again"

That's an unfair and inaccurate way to present Anita's answer. They answered with transparency, did not try to bail out of responsibility, and exposed what they were doing as of right now to remedy to the situation.

Privacy problems are not jokes, and I fully expect them to have a complete post-mortem, evaluation and think about what happened before reporting the steps they are doing. I would totally not trust a company that, after having such a leak, answered the next day with a vague "yeah we understood everything and did this since yesterday".

How much time do you think it takes to review processes, with actual people that know about the topic, and make good decisions? It's been two weeks. If they'd answered the next day, I, for one, would actually be extremely suspicious that they'd actually take the matter seriously.

I agree that [...] the usual 6-8 is not good enough, but there should be some kind of middle-ground, I believe.

  • 11
    Thanks for the answer, but I feel its pointless. Aside from the disagreement of the answer they gave, I feel like they should certainly give us an update, at least a "we are working on it". In the original post, this was asked several times (I did ask twice), and they did not give any comment in them actually doing something about it. That makes me extremely suspicious that they are hoping to sweep it under the rug, the same way they did of the previous one (linked in the question). Your hypothesis of them doing something is just that, hypothesis, and therefore it does not answer the question. – Ander Biguri Feb 18 '19 at 17:16
  • 1
    Your hypothesis that they are not, is equally just that, an hypothesis @Ander. That is a pointless statement, we both have hypothesis. – Félix Gagnon-Grenier Feb 18 '19 at 17:22
  • 7
    @FélixGagnon-Grenier The point is that no hypothesis is a proper answer. OP is not offering their hypothesis as one and their question is an attempt to seek resolution for the hypothesis. I believe that only someone working this issue at stackoverflow is capable of providing a worthy answer here. The rest of us, and our opinions on this matter, will have to wait on the sidelines. – JNevill Feb 18 '19 at 17:25
  • 1
    @JNevill Neither am I offering mine as an answer. I am addressing the way the question is presenting SO's response. This is not main. – Félix Gagnon-Grenier Feb 18 '19 at 17:27
  • 3
    @FélixGagnon-Grenier If you are only complaining about "sorry wont happen again", its strange. You may not like the wording, but it is what happened. They answered with transparency "oops", the did not try to bail out of responsibility "sorry", and and exposed what they were doing as of right now to remedy to the situation, "wont happen again". There is really no more information in their answer. "We are reviewing our policies" is a reworded "won't happen again". So you agree with my wording, I'd say. I still see no purpose in this asnwer – Ander Biguri Feb 18 '19 at 17:36
  • 20
    That's ok @Ander. You see no purpose in my answer, I see no purpose in your question. It doesn't mean either of us should delete our post. As for the wording, no, I don't think that the demagogic and charged "oops, sorry, won't happen again" amounts to the same tone as Alita's answer. I don't agree with your wording. Wording matters. – Félix Gagnon-Grenier Feb 18 '19 at 18:05
  • 4
    It is a cultural problem. Stack Overflow is family of sites originating in US, and here the private data culture is still lacking. And most people do not consider your email address such a private data after all. Only in certain heavily regulated industries (like healthcare, for instance) personal data protection is seen at levels on par with European ones. – SergeyA Feb 19 '19 at 16:12

Not the answer you're looking for? Browse other questions tagged .