Stadia Maps Privacy Fail

This is a tale as old as email, but it made me laugh so I thought I'd share it. I have an account with https://stadiamaps.com. I don't even remember setting it up, so it's certainly not something I've used in a long time.

Anyway, I received an email from them today:

Subject: [Legal Notice] We've updated our legal docs

It contains information about how they've updated their Terms of Service, Privacy Policy and published a new Data Processing Addendum. According to the email, this is for my protection. Also:

Our privacy stance has not changed: it remains fiercely privacy-first.

Fiercely privacy-first. Impressive! Can you guess what they did? Yeah... They put 1,000 of their users email addresses right there in the To header. Luckily I used a custom email address for them, as I do for all companies, so it doesn't matter that my email was leaked:

Just over an hour later, I received this from their CEO, Luke Seelenbinder:

I'm writing to let you know that the Legal Notice email I sent earlier today > was sent with multiple recipient addresses visible in the To field. That was > my mistake, and I'm incredibly sorry.

Ouch. I bet you're not having a good day.

I want to be straightforward: your email address was visible to some of the > other recipients of that message. No other personal data was exposed.

If you wanted to be straightforward you would have said ~1,000 instead of "some".

We've taken steps to prevent this from happening again. I'd ask that you > please delete the original message and do not use the recipient list for > any purpose.

Good luck with that.

We build our business on privacy as a principle. That makes this mistake > especially frustrating, and it's one I take personally. You deserve better.

How do you, "build your business on privacy as a principle?" The same way as every other business that, "takes my privacy seriously" I bet. Easiest claim in the World to make.

If you have any questions or concerns, reply directly to this email and I'll > respond personally.

At least you didn't include 1,000 emails in your second email's To header I suppose.

I guess it's not entirely his fault. The email was sent through Mailgun. How does Mailgun not prevent this from happening? Crazy.