BestBuy (and others) Disclose My Email Addr
Update 5 April 2011: This is a big story. A big IT services FAIL: http://www.cbc.ca/news/business/story/2011/04/05/business-data-breach.html?ref=rss
I’m getting ready for the wave of spam. BestBuy’s direct email service (i.e., legitimate spam) was hacked and the attackers got real, live email addresses:
http://www.thestreet.com/story/11070689/1/retailers-victims-of-e-mail-hackers.html?CM_VEN=AD|TWR|JC
On the one hand, this is no big deal. On the other, it’s kind of annoying — not the incident, but the typical response from a BestBuy corporate VP of — Marketing. Yes, the customer notification doesn’t come from tech staff, but rather from the spin machine. (see email in entirety below)
I love the vagueness in these notification emails assuring users that nothing else of value was disclosed and that the “appropriate authorities” were notified.
Just once, I’ve love an honest message: “We have no idea what they actually got, and neither do the 3rd-party consulting firm or the FBI. I’m sorry we left the default password as ‘password’ on our firewall. We’ll give you $10 of BestBuy credit toward your next purchase.”
What I find lovely is that our (by which I mean the information security community) best advice boils down to six relatively useless recommendations:
http://www.geeksquad.com/do-it-yourself/tech-tip/six-steps-to-keeping-your-data-safe.aspx
—
Dear Valued Best Buy Customer,
On March 31, we were informed by Epsilon, a company we use to send emails to our customers, that files containing the email addresses of some Best Buy customers were accessed without authorization.
We have been assured by Epsilon that the only information that may have been obtained was your email address and that the accessed files did not include any other information. A rigorous assessment by Epsilon determined that no other information is at risk. We are actively investigating to confirm this.
For your security, however, we wanted to call this matter to your attention. We ask that you remain alert to any unusual or suspicious emails. As our experts at Geek Squad would tell you, be very cautious when opening links or attachments from unknown senders.
In keeping with best industry security practices, Best Buy will never ask you to provide or confirm any information, including credit card numbers, unless you are on our secure e-commerce site, www.bestbuy.com. If you receive an email asking for personal information, delete it. It did not come from Best Buy.
Our service provider has reported this incident to the appropriate authorities.
We regret this has taken place and for any inconvenience this may have caused you. We take your privacy very seriously, and we will continue to work diligently to protect your personal information. For more information on keeping your data safe, please visit:
http://www.geeksquad.com/do-it-yourself/tech-tip/six-steps-to-keeping-your-data-safe.aspx.
Sincerely,
Barry Judge
Executive Vice President & Chief Marketing Officer
Best Buy
Update 4 April 2011: It looks like Marriott used the same service. This is a cloud failure mode. Think about it. All I need to do is attack a single vendor, and I get multiple information streams.
April 4, 2011
Dear Marriott Customer,
We were recently notified by Epsilon, a marketing vendor used by Marriott International, Inc. to manage customer emails, that an unauthorized third party gained access to a number of Epsilon’s accounts including Marriott’s email list.
In all likelihood, this will not impact you. However, we recommend that you continue to be on the alert for spam emails requesting personal or sensitive information. Please understand and be assured that Marriott does not send emails requesting customers to verify personal information.
We take your privacy very seriously. Marriott has a long-standing commitment to protecting the privacy of the personal information that our guests entrust to us. We regret this has taken place and apologize for any inconvenience.
Please visit our FAQ to learn more.
Sincerely,
Marriott International, Inc.
and the FAQ has this content:
April 4, 2011
What happened?
Marriott International Inc. was recently notified by Epsilon, a marketing vendor used by Marriott to manage customer emails, that an unauthorized third party gained access to a number of Epsilon’s accounts including Marriott’s email list.What Marriott information was accessed?
The unauthorized person(s) had access to names and email addresses only. They did not have access to sensitive customer information, such as physical addresses, loyalty program point balances, account logins and passwords, credit card information or other personal data.How does this affect Marriott customers?
There is a possibility that customers whose email addresses were obtained may receive unsolicited emails (i.e., spam or phishing). Marriott has a long-standing commitment to protecting the privacy of the personal information that our guests entrust to us. As a result, Marriott never sells or rents member lists.What is Epsilon doing about this?
Epsilon has notified Marriott that they have identified where the breach took place and has taken the necessary steps to prevent additional data loss. Epsilon has further informed us that they have notified law enforcement and that additional security precautions have been put in place to help prevent future incidents.
Permalink Comments off
