2 ms·
> Luttwak's team found the problem, dubbed ChaosDB, on Aug. 9 and notified Microsoft Aug. 12, Luttwak said. Then mailing customers on the 26th. Depending on w
by miken123 5y ago
> Luttwak's team found the problem, dubbed ChaosDB, on Aug. 9 and notified Microsoft Aug. 12, Luttwak said.
Then mailing customers on the 26th.
Depending on whether or not this can be classified as a 'personal data breach' (IMO you should treat it as such, since it has such widespread implications) that may be a GDPR violation. The GDPR requires 72h notice to the data protection authorities and notice without 'undue delay' to the controller.
- kerng 5y agoIt doesnt sound like a breach (in the legal sense) occured, at least with the knowledge at hand. Microsoft has bug bounty programs, so such hacking is legally covered and processes seem to have been followed (e.g. researcher didn't unnecessarily access data they didnt own etc). Will be interesting to learn more info down the road