back to article Timehop admits to more data leakage, details GDPR danger

Nostalgia aggregator Timehop has revised its advice about the data breach it reported earlier this week. The news is bad in two dimensions, the first of which is that the company has found more data was accessed. Updates to its oops! post has now added “dates of birth, gender [and] country codes” to the list of lost …

  1. Mayday


    That's a lot of people and a lot of info. Glad I'm not one of them.

  2. Anonymous Coward
    Anonymous Coward

    Glad I'm not a hipster

    No beard either.

    1. Warm Braw Silver badge

      Re: Glad I'm not a hipster

      Not having heard of Timehop, I took a quick look at their website to see what it might do.

      Front page is a big picture with a meaningless strapline. The "About Us" offers the meaningless puff:

      Timehop created the digital nostalgia category and continues to be THE team reinventing reminiscing for the digital era.

      The rest of their site seems to be about advertising opportunities. So I'm none the wiser as to its purported function. This seems to be pretty typical of the social media app - you're supposed to find out about it through viral marketing and want it because of its name and its "vibe", regardless of what it actually does.

      Which seems in this case to be equally typical of the social media app - it collects your personal information in order to sell you stuff and carelessly spills it over the Internet.

      Disclaimer: I have a beard, but it's grey.

      1. Anonymous Coward
        Anonymous Coward

        TimeHop is used in Facebook

        I didn't even know it was a separate company until I saw this article, I assumed it was a part of Facebook since that's the only place I'd ever seen it. I wonder if all the compromised accounts were people who accessed TimeHop directly, or if some of them were people who had only ever used it via Facebook?

        Given how freely Facebook seems to let third parties access data, especially one that seems particularly closely integrated like TimeHop is, I think I know the answer to that...

        Would Facebook face any penalties under the GDPR if they gave TimeHop access to the user data but it was TimeHop who screwed up and let it escape? TimeHop probably has little in the way of resources, so I know which one I'd rather go after!

        1. GnuTzu
          Big Brother

          Re: TimeHop is used in Facebook

          Imagine if Cambridge Analytica's data slurp included entire Facebook histories--even stuff long deleted or hidden. (Mind you, I'm not sure I've accurately stated this for the way that Facebook really works, as I've never had an account.)

          1. Anonymous Coward
            Anonymous Coward

            Re: TimeHop is used in Facebook

            Even if Cambridge Analytica's didn't, we shouldn't assume other third parties who "worked with" Facebook didn't get exactly that. If they were around long enough, even without access to deleted stuff they had a chance to grab it before deletion.

            I found it interesting when it was recently reported that Google was letting third parties access people's actual GMail accounts, which begs the question what else they've given permission to root around in. Governments of the world wouldn't need explicit cooperation from Facebook/Google if posing as various third parties let them grab what they want while providing Zuck and Page deniability when asked "do you give government X access to user data without a warrant?"

            Technically they wouldn't be lying if the access was granted to a Cambridge Analytica like front for the NSA, or multiple fronts that each collect different data. Then even Facebook and Google don't quite know the extent of what the government is looking at (which only helps them be able to keep a straighter face when saying "we do not provide access to any of our data without a warrant")

  3. Pascal Monett Silver badge

    "by the time incident response processes kicked in"

    That means that "incident response" is the headless chicken phase of the IT department panicking amongst calls from upper management to know what the hell is going on, preventing anything from actually being done.

    Brilliant example of closing the stable door after the horse has bolted.

    Now maybe would the time to analyse proper network surveillance options and revise the security procedures ? Nah, just make noise about how security is at the heart of everything you do and lessons will be learned to prevent this from ever happening again until next time.

    Tomorrow it'll be business as usual anyway, so why spend money that could go to CxO bonuses ?

    1. DropBear

      Re: "by the time incident response processes kicked in"

      Bet you how much that there could be a sizeable GDPR fine lobbed at them and the usual CxO bonuses would STILL happen...?

    2. Amos1

      Re: "by the time incident response processes kicked in"

      I suspect you're assuming the stable door is in fact closed. Or closed but perhaps not locked. Deficient information protection practices are pervasive in companies.

  4. rmason

    run the numbers

    Isn't that going to be quite a sizable fine?

    Should be the first time we see if GDPR has teeth,

    1. Nick Ryan Silver badge

      Re: run the numbers

      The fines are the for repeat and flagrant offenders, particularly those that don't even try to maintain privacy. While there is an element of punishment/risk in fining organisations after a breach, if the organisation that was breached behaved well and did what they could and it's a first incidence of the time then they are quite unlikely to be fined. If you're a large, or well funded organisation, and don't do your best you will be in trouble though.

      On the other hand, the buggers whose business model is hoovering up personal data directly and indirectly and then using this to build profiles of the data subjects and the data subject's contacts... they will receive fines regardless of a malicious breach.

  5. Dan Wilkie

    I'll be honest on this one, it's surprising me how transparent they're being considering the potential penalties It makes it hard for me to hate them. Which is probably the idea. What utter bastards!

    1. Anonymous Coward
      Anonymous Coward

      It's exactly because of the potential penalties they're being open. GDPR fines are not automatic, and the amount can be "up to" - but many factors will play their role when the authority in charge decides them.

      Keeping issues hidden (Equifax...) *could* have had a pejorative impact on any fine that could be inflicted upon them.

      This could be the first test of how GDRP works - let's keep an eey on it....

  6. Doctor Syntax Silver badge

    "The steps that followed suggest swift escalation to the C-suite, but by the time incident response processes kicked in the data was gone."

    This implies that incident response had to be invoked by the C-suite and that the time involved was crucial. In that case there needs to be standing permission for sysadmins to respond immediately. It's an area the relevant regulator will need to check on in deciding what action to take.

  7. tiggity Silver badge


    The first rule of DOB is to lie on websites

    Only organizations that really need it e.g. bank, doctor, HMRC should get it.

    Some random website should not get key PII that is a cornerstone of identity fraud.

    Too many sites have mandatory DOB - interested to see GDPR scupper that .. if a site has minimum age requirements then all it needs is tickbox to confirm over "n" years, and not require core PII

    .. Yes I am aware lots of people freely use correct DOB on social media - they are probably clueless on how easy identity theft is (also is anyone posting details of birthday to social media, no point hiding DOB if you upload 21st (or whatever) birthday party photos to FB, similarly resist classic ID question data such as pet names etc on social media)

    ... Frankly, just say no to privacy risking social media

  8. Aodhhan

    Well done.

    A company using primarily servers facing the Internet fails to use MFA for administrators.

    You have to consider the CIO neglectful in their duties for not ensuring MFA is implemented

  9. David Gosnell

    How many others?

    How many other services, websites and apps like this are there, long-forgotten and barely-maintained flashes in the pan running on last-decade technology and security/privacy principles? Surely a massive powderkeg / can-of-worms / [insert metaphor of choice] with all this abandonware holding so much personal information. Thankfully TimeHop is one I never saw the point in so never participated in, but I know many who did.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2022