4 ms·
I’m not happy with how Backblaze handled informing affected users at all. They were aware of it on March 21 and said that they “were preparing a communication
by kevingrahl 5y ago
I’m not happy with how Backblaze handled informing affected users at all.
They were aware of it on March 21 and said that they “were preparing a communication with affected users at that time”.
I received an email about that only yesterday.
That’s 52 days it took them to write me an email which imo just isn’t good enough and afaik does not conform with the GDPR requirements for data breaches.
- bastawhiz 5y agoIt sounds like the data leaked was not PII, which is outside the scope of GDPR personal data breach guidelines.
- magicalhippo 5y agoFilenames were leaked, which could very well contain PII.
- Nextgrid 5y agoSomething as simple as an IP address (which you're implicitly leaking by just loading any resource from the third-party domain) is considered PII under the GDPR.