How was it possible to discover it, though?
They were still logged in and refreshed the page; they found out by going to their user settings.
Changing object name data though is a terrible practice to implement this.
Otherwise imagine how easy it would be to violate the deletion request if you're running a business and can't remember the names of the people you had deletion requests for. Their data could come up again through normal channels and you'd treat them no differently than another sales contact, thus violating GDPR.
You catch a lot, with catchall: dataleaks, hacks, sneaky data sales etc. When suddenly you recieve, say, marketing mail for shirts on 'jeansonline@example.com' something fishy is going down.
Having done enough security audits, "this was legacy" is a BS excuse. I will go ahead and assume that NYT have an audit department. And that audit dept runs throug the full audit universe every 4-5 years. Someone would have captured that a long time ago (1st, 2nd, 3rd lines)(external auditors)(any sales pitch: "we have 438264728 subscribers")
I call BS. They got busted and now they most likely change this from 1000 to 2000 and call it a day..
Ps: bemis is not my real last name.. but I am using a super cool name over here!!