This is a bad article and what it claims is just wrong: > the data they received also came with metadata that included the email addresses tied to anonymous Di

This is a bad article and what it claims is just wrong: > the data they received also came with metadata that included the email addresses tied to anonymous Disqus accounts What they received were Gravatar URLs which include the MD5 hash of the senders email address. Obviously you can scrape the web and find more avatars with a matching email address hash and start mapping them to the same author. You can also try brute forcing the hash to find the original address, but all that is not a Disqus security breach. It's scraping public websites, maybe one could call it social engineering, but after all it's a targeted attack and no flaw in Disqus. There is of course something wrong with making email hashes public through avatar URLs, but that's all Gravatar's fault. Many people probably want to see Gravatar support on the websites they use, and it's also very easy to implement by developers. It's pretty much a monopoly and they're the only ones to fix it.