It's personal data breach for the controller (Lovable or the company that manages the app. Probably latter unless they are determined to joint controllers). It's not breach for the researcher. The researcher(s) themselves need legal basis to obtain this information which would likely be "legitimate interest" and then follow the other principals of GDPR (like deleting the data when no longer needed).
One thing they could potentially get in trouble for is Article 14 notification to data subjects (since they have emails), but that's not very heavily enforced. DPA would probably just tell to send the notification.
> It's not breach for the researcher. The researcher(s) themselves need legal basis to obtain this information which would likely be "legitimate interest" and then follow the other principals of GDPR (like deleting the data when no longer needed).
Good luck arguing that you had legitimate interest in data of people who did not consent to you having it in the first place.
The GDPR does not have a 'legitimate interest' category that includes exploiting breaches. White hat hackers are neither processors nor controllers and can never claim legitimate interest in the data.
These are all separate code bases with different owners, different database designs and different security frameworks. The only thing they have in common is being built by AI using loveable (which sells itself as allowing anyone to build web apps but arguably doesn't do enough help the user make those apps secure)
Yes, absolutely. And the common element here strongly points at Lovable setting things up in such a way that this kind of vulnerability can easily be the result of using their product. I really don't buy their position that they have no responsibility here, as far as I can see Supabase, Lovable and the customers of Lovable all failed to do right by the data subjects. Every one of those websites whose data was downloaded effectively has a reportable breach on their hands and Lovable and Supabase have one as well.
If they wipe this under the carpet the lot of them could be in really hot water if a regulator finds out. I tried asking the CISO of Lovable up-thread about this but they never answered, and I really think those questions need to be answered, and need to be answered publicly.
POC -> fine
Actual mass exfiltration -> not fine.
https://gdpr-info.eu/art-4-gdpr/ section 12.
Under the GDPR this was a breach, pure and simple.
One thing they could potentially get in trouble for is Article 14 notification to data subjects (since they have emails), but that's not very heavily enforced. DPA would probably just tell to send the notification.
Good luck arguing that you had legitimate interest in data of people who did not consent to you having it in the first place.
The GDPR does not have a 'legitimate interest' category that includes exploiting breaches. White hat hackers are neither processors nor controllers and can never claim legitimate interest in the data.
These are all separate code bases with different owners, different database designs and different security frameworks. The only thing they have in common is being built by AI using loveable (which sells itself as allowing anyone to build web apps but arguably doesn't do enough help the user make those apps secure)
If they wipe this under the carpet the lot of them could be in really hot water if a regulator finds out. I tried asking the CISO of Lovable up-thread about this but they never answered, and I really think those questions need to be answered, and need to be answered publicly.