Mermaids UK, an organisation founded by parents of transgender children and dedicated to supporting them, apologised last week after it emerged that private messages exchanged between the organisation and parents were inadvertently exposed.
According to reports, over 1,000 confidential emails were leaked online. These emails contained very personal information about the children the organization helps. Among this information were names, addresses, and phone numbers.
In data breaches, hackers infiltrate the internal networks of companies and organizations and steal information. They then either publish the stolen data online or sell it on the dark web.
In the case of the Mermaids UK data breach, the data was simply uploaded online. However, this means that anyone could have accessed it.
The organization was notified of the data leak on Friday and immediately removed the content from the internet.
Mermaids UK called the data breach "unintentional" and stressed that there was no evidence that personal information had been misused.
Mermaids said that about 1,100 emails were leaked. It added that the emails came from a “private group of users” and that “the information could not have been discovered unless someone knew it was available.” This, of course, is not a very convincing argument, since with a simple Internet anyone could have found the information.
The organization notified the UK Information Commissioner's Office (ICO) of the breach, which has been required since 2018 under the General Data Protection Regulation (GDPR).
According to these rules, organizations must report incidents of violation in a timely manner, otherwise they may receive a fine.
Mermaids, of course, also informed the families affected by the data.
The organization stated the following: “Mermaids apologizes for the violation. Although we acted immediately, we regret it. Now, there is appropriate technical support and we believe that no further violations will occur in the future.”.
