Speaking of GDPR compliance, and as some in the Reddit thread have pointed out, the GDPR requires disclosure of serious data breaches to the affected users with

Speaking of GDPR compliance, and as some in the Reddit thread have pointed out, the GDPR requires disclosure of serious data breaches to the affected users without "undue delay", and to the relevant supervisory authority within 72 hours: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/ https://ico.org.uk/for-organisations/guide-to-the-general-da... It will be interesting to see what consequences, if any, Reddit end up facing over this.