[kevingrahl]

I’m not happy with how Backblaze handled informing affected users at all.

They were aware of it on March 21 and said that they “were preparing a communication with affected users at that time”.

I received an email about that only yesterday.

That’s 52 days it took them to write me an email which imo just isn’t good enough and afaik does not conform with the GDPR requirements for data breaches.

[bastawhiz]

It sounds like the data leaked was not PII, which is outside the scope of GDPR personal data breach guidelines.

[magicalhippo]

Filenames were leaked, which could very well contain PII.

[Nextgrid]

Something as simple as an IP address (which you're implicitly leaking by just loading any resource from the third-party domain) is considered PII under the GDPR.