I didn't see it, but "who is the third party vendor?" is my key question, since this could be impacting anyone working with that vendor.
> we will review our policies for enforcing 2FA on third-party accounts to the extent possible, and continue our transition to single sign-on (SSO) for all of our integrations
I think it is more likely the CircleCI didn't enforce 2FA or SSO[1] with the vendor, and a CircleCI employee reused an already compromised password.
[1] Nearly all SSO identity providers support 2FA, so using SSO is often the easiest way to get 2FA with third-party SaaS providers.
In general what I’m missing is why they share my email and github account with a 3rd party. GDPR should prevent them from doing so (at least for European users) without a legitimate reason, or explicit consent.
If you as the data controller are allowed (according to GDPR) to do some particular processing of some particular data, then GDPR also allows you to subcontract that processing, and thus provide the data to third parties (data processors).
There are a bunch of restrictions in place (you have to have a specific contract mandating that they only do the thing with the data you're contracting them to do, you're responsible if they violate that, some restrictions on "exporting" data out of EU), and you have to inform the customer to what third party 'data processors' you (as the data controller) are outsourcing these activities - so CircleCI would be required to give an exhaustive list of all the data processors to which they have given your data, but you don't need explicit consent or a very particular reason for that outsourcing.
What is prevented by GDPR is the common (at least in USA) "sharing data with trusted third party partners" where the data is essentially sold to third parties which are free to use that data as they wish for their own business or re-sell it further. That would require a very particular reason or explicit consent, but this is not the common scenario of outsourcing to a GDPR-compliant vendor.
So if the email is required in order to, say, send me notifications about CircleCI jobs that are running. That's a legitimate reason. If they share my email with the 3rd party to, for example, optimize their onboarding flows, then this isn't legitimate, unless I explicitly gave my consent to it.
To me, "analytics vendor" as they stated it, usually implies something similar to the latter rather than the former. But since they didn't indicate the provider, nor the reason, I can't really say.
I think we're not in any disagreement here by the way.
Error logs might be a bit different I suppose, if they are used to help resolve specific issues for your users, but even then I suppose one could argue that pseudo-anonymised data would be better than sharing an email address.
I'm no GDPR expert, but that's my understanding of it.