So you're a legal expert now too? You characterization of what happened as "mass exfiltration" is just that - your personal opinion.

▲

jacquesm a day ago | parent [-]

No, OP documents that in painful detail.

https://gdpr-info.eu/art-4-gdpr/ section 12.

Under the GDPR this was a breach, pure and simple.

▲

buzer a day ago | parent | next [-]

It's personal data breach for the controller (Lovable or the company that manages the app. Probably latter unless they are determined to joint controllers). It's not breach for the researcher. The researcher(s) themselves need legal basis to obtain this information which would likely be "legitimate interest" and then follow the other principals of GDPR (like deleting the data when no longer needed).

One thing they could potentially get in trouble for is Article 14 notification to data subjects (since they have emails), but that's not very heavily enforced. DPA would probably just tell to send the notification.

	▲	jacquesm a day ago \| parent [-]
		> It's not breach for the researcher. The researcher(s) themselves need legal basis to obtain this information which would likely be "legitimate interest" and then follow the other principals of GDPR (like deleting the data when no longer needed). Good luck arguing that you had legitimate interest in data of people who did not consent to you having it in the first place. The GDPR does not have a 'legitimate interest' category that includes exploiting breaches. White hat hackers are neither processors nor controllers and can never claim legitimate interest in the data.

▲

liquid_thyme a day ago | parent | prev [-]

"pure and simple" is again - YOUR interpretation. Sorry, but this is genuinely not interesting anymore. But thanks anyway for engaging. Good luck.