26

I used to have an account with id user:12361700 with more than 12,000 points on Stack Overflow. Eight hours ago, I could log in without any problem, but this morning, without any prior warning nor notification, my account seems to have disappeared.

I didn’t receive any flags. I have never done spam nor anything. I have been here for the past like five years, helping people on multiple websites of this community, and my account has vanished without any apparent reasons.

What should I do? Why does it seem to have been deleted (if I try to recover the password, I get that my email does not exist)?

15
  • 11
    You might also want to use the contact link at the bottom to contact support directly Aug 2, 2023 at 12:12
  • @JourneymanGeekOnStrike I did it, but I would like to have an idea on how this happened, i dont even have a reason why to appeal, because I have no idea what's the issue (i've put the password issue as reason, but this is definitely not a password issue)
    – Alberto
    Aug 2, 2023 at 12:13
  • 2
    Only thing I can think of is a DSR request - did you make one of those recently? When you escalate to support on Stack Overflow make sure to include the e-mail address(es) you might have used (but don't post those here), as the legal department could use that information to cross-check any requests that came in via OneTrust.
    – Aaron Bertrand Staff
    Aug 2, 2023 at 12:38
  • 3
    Any link to one of your old posts using that user? It would be interesting to see what they display as the username
    – SPArcheon
    Aug 2, 2023 at 12:39
  • @AaronBertrand I have no idea what I'm looking at when I open that link, so i definitely never submitted one of those... I currently have submitted 2 requests via contact/support form in the footer of this page and emailed [email protected] with the same complaint/request...
    – Alberto
    Aug 2, 2023 at 12:41
  • 1
    @SPArcheon sure ai.stackexchange.com/questions/41359/…
    – Alberto
    Aug 2, 2023 at 12:41
  • 1
    horrible guess... Your account was a registered account with username and password, right? You didn't manage to get all that rep as an unregistered user, right?
    – SPArcheon
    Aug 2, 2023 at 12:45
  • @SPArcheon yes, I though it might be that my password was leaked somewhere (even though it's strange because i use a different one for every website) and somebody delete/change something, but I have not received a single email of notification of this
    – Alberto
    Aug 2, 2023 at 12:46
  • @SPArcheon i actually have no idea what is a unregistered account, I can tell you for sure that it was all well set up... and had my usual account, just like the one I'm using right now (aka, until yesterday, instead of "anon" there would have been my name and my account)
    – Alberto
    Aug 2, 2023 at 12:47
  • I guess that only the staff can help you then, best I can try is to see if I can get someone on the chat to look at this.
    – SPArcheon
    Aug 2, 2023 at 12:48
  • @SPArcheon yes please, I would be so thankful to you, i really have no idea what's going on...
    – Alberto
    Aug 2, 2023 at 12:48
  • 22
    I've already raised it to legal/privacy.
    – Aaron Bertrand Staff
    Aug 2, 2023 at 12:48
  • 1
    @AaronBertrand thank you so much for your support and the time you are spending/taking to face this problem
    – Alberto
    Aug 2, 2023 at 12:49
  • 18
    @Laurel for the moment, for what i've understood so far, it seems that they processed a 4yo deletion request that i made for the account, which however was referring to an account that had already been successfully deleted, thus they associated that request with my new one, causing all of this...
    – Alberto
    Aug 2, 2023 at 14:26
  • 1
    @Alberto A similar thing has happened to me, but with much smaller impact. I accidentally uploaded an image containing sensitive info, and immediately replaced it with a redacted version and requested that the original sensitive version be deleted. Some time later, the redacted version was also deleted despite it not having any sensitive info, as somehow my original request had resurfaced. Aug 2, 2023 at 22:53

1 Answer 1

20

The short version:

Alberto's account did in fact "disappear" recently. This was attributed to an erasure request in the past that was inadvertently included in an otherwise intentional reprocessing. We have resolved the issue by restoring their account data and re-associating their content.

But I want the details!

As Alberto shared in a comment, an account deletion was requested a few years back. A new account was then created using the same e-mail some time after the erasure was requested. Essentially, intending to be a "start over from scratch."

When we receive an erasure request, we record the date in a table. When it has completed, and when we notify the user, we record those dates, too. In most cases, we have completed the erasure and notified the user before they have a chance to create a new account. In a few edge cases, like in Alberto's, the recorded dates for completion / notification indicated that the new account was created prior to the deletion request completing in its entirety.

Earlier this year, we made multiple improvements to our DSR and erasure process. To ensure that any past erasures were consistent with our more modern process, we chose to push some of those through again.

To do this, we collected a list of past erasure requests and filtered out any that had created a new account since. The filter, unfortunately, deemed any new account to not be new at all, in the event that the new account was created before the completion and/or notification date of the erasure. So while Alberto's new account should have been safe from reprocessing, the unfortunate timing issue mentioned above actually pushed the new account through another erasure process.

Thankfully, if caught quickly enough, we can “recover” a majority of a user’s contributed data from a recent set of backups. Most of the erasure process is, in fact, disassociating the user generated content and anonymizing, not deletion. This recovery process is neither fun, nor easy; it is a tedious affair full of sweat and nerves that involves restoring multiple database copies to a point in time and performing surgical data operations across databases on two different servers. This is by design, as there is not meant to be an easy "undo" button for an erasure request, for obvious reasons.

(Wouldn't Ctrl + Z be nice?)

Action items:

  • We have suspended reprocessing of older erasures, and need to improve guardrails around which erasure requests should be eligible for re-processing.
  • We will continue investigating the source of the data issue, and implement a fix for the check logic to avoid affecting more users in the future.

Takeaways:

My two takeaways I can share with our users, and they both relate to taking erasure requests very seriously:

  • Make sure you really want it. In this case, it was our mistake. If you survive all the prompts and then come back and say maybe that wasn't what you really wanted, it's going to be difficult to justify the effort. And if you wait too long (days, essentially), it won't be possible anyway.
  • If you do perform an erasure and later want to sign up again, try to avoid using the same e-mail address. While it is certainly possible, and we aren't going to block it, it does add unnecessary complexity and makes your new account potentially vulnerable to mistaken identity, regardless of any safeguards we add for this specific edge case.
4
  • I always found it unintuitive how requesting to make one thing gone, first creates a separate thing: the record of what shall be deleted. How long after someone requests to delete all their data is the information referring to that request deferred from said deletion?
    – anx
    Aug 4, 2023 at 22:52
  • @anx That's one of the reasons we can't actively block reuse in the future. How some companies do it is just like password storage - you store the e-mail address in some hashed/encrypted/salted form and compare the hashed/encrypted/salted form of any new incoming e-mail address to all those you have processed before. Multiple technical implementations are certainly possible, but there has to be some justification to want to do it in the first place. Me finding it a pain in the rear to restore data in cases like this is not exactly sound business justification on its own. :-)
    – Aaron Bertrand Staff
    Aug 5, 2023 at 0:25
  • Rephrasing the question: What is the effective expiration date on entries in that past erasure request table? Even more interesting than whether the signup form can be made to reveal that tables entries would be: whether the mechanism is clearly communicated to the affected person. "We deleted everything associated with this mail, once" versus "We deleted everything associated with this mail, except the request to do so, that will be stored and deemed valid until 2023-11-02"
    – anx
    Aug 5, 2023 at 0:59
  • @anx I'd have to ask legal/privacy folks for all the details. I just implement the data side. The process we have in place today does not store the e-mail address on our side at all, as far as I know; that's all handled via OneTrust.
    – Aaron Bertrand Staff
    Aug 5, 2023 at 16:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .