Ask Slashdot: How To Convince a Company Their Subscriber List Is Compromised? 247
jetkins writes "As the owner of my own mail domain, I have the luxury of being able to create unique email addresses to use when registering with web sites and providers. So when I started to receive virus-infected emails recently, at an address that I created exclusively for use with a well-known provider of tools for the Systems Administration community (and which I have never used anywhere else), I knew immediately that either their systems or their subscriber list had been compromised. I passed my concerns on to a couple of their employees whom I know socially, and they informed me that they had passed it up the food chain. I have never received any sort of official response, nor seen any public notification or acceptance of this situation. When I received another virus-infected email at that same address this week, I posted a polite note on their Facebook page. Again, nothing. If it was a company in any other field, I might expect this degree of nonchalance, but given the fact that this company is staffed by — and primarily services — geeks, I'm a little taken aback by their apparent reticence. So, since the polite, behind-the-scenes approach appears to have no effect, I now throw it out to the group consciousness: Am I being paranoid, or are these folks being unreasonable in refusing to accept or even acknowledge that a problem might exist? What would you recommend as my next course of action?"
Is it fixed? (Score:5, Interesting)
Maybe they did fix the issue, but its difficult to take away the compromised list once someone else has it. Or were you expecting them to track down the virus senders and delete the lists from those servers?
Re: (Score:2, Interesting)
Maybe they did fix the issue, but its difficult to take away the compromised list once someone else has it.
I was about to grab the pitchforks when I read this and thought it was actually a reasonable explanation. Mod parent up.
Re:Is it fixed? (Score:5, Insightful)
I do the same thing as the author in the article. To confirm this you need to change the email address you received the spam from at the same time you notify the company.
e.g.
becomes
If 'thecompany2' address gets spam they're still compromised. Repeat until fixed or you lose trust in 'thecompany'.
Re:Is it fixed? (Score:4, Insightful)
Re: (Score:3)
Re: (Score:3)
I do the same thing as the author in the article. To confirm this you need to change the email address you received the spam from at the same time you notify the company.
e.g.
becomes
If 'thecompany2' address gets spam they're still compromised. Repeat until fixed or you lose trust in 'thecompany'.
Personal admission: I am already at amazon5@yadayada.
Re: (Score:3)
Maybe they did fix the issue, but its difficult to take away the compromised list once someone else has it. Or were you expecting them to track down the virus senders and delete the lists from those servers?
If they don't acknowledge that there was even a problem, how would he know if it's "fixed"? Besides, if a customer list was stolen, it's likely more than just email addresses, and some states [wikipedia.org] require public disclosure if personal data is stolen.
Re:Is it fixed? (Score:5, Interesting)
If they do acknowledge the problem, how would he know if it's fixed? Once the data is out there, it's out there. Acknowledging it is likely to be against the advice of the company's attorneys whether or not it really is their fault.
Re:Is it fixed? (Score:5, Informative)
Acknowledging it is likely to be against the advice of the company's attorneys whether or not it really is their fault.
Exactly. Datek or Ameritrade or TD Ameritrade, I forget at which point in their many buy-outs, has been repeatedly compromised in the past. At first they denied it and claimed that spammers had just guessed by email account. So each time I would create a new email account in my own domain consisting of a random collection of 12 letters, numbers, and punctuation marks. And each time they were compromised I would point out to them the impossibility of a spammer guessing my email account.
Finally, they just started a policy of sending me an email saying they are investigating it but their company policy does not allow them to give me any details of their findings or what, if anything, they did to fix it.
Re:Is it fixed? (Score:5, Interesting)
Maybe they did fix the issue, but its difficult to take away the compromised list once someone else has it. Or were you expecting them to track down the virus senders and delete the lists from those servers?
Maybe notify members of the list that the list has been compromised and they might be getting virus loaded emails?
Re:Is it fixed? (Score:5, Insightful)
They need to at least confirm to him that they took him seriously and are at least attempting to track down the leak so that no more addresses leak out. Chances are they've got at least one PC with malware harvesting email addresses. If that's the case, they probably have other malware too.
Re:Is it fixed? (Score:5, Interesting)
I had exactly the same issue as the OP this past week, but with a Fortune 1000 company whose business model revolves around collecting and selling information about people.
I contacted their information security department, and sent them the emails and headers at their request. I haven't heard from them since.
The problem is that not only did I get emails to an address that only that company has; my social security number was also in the emails. So whoever got the emails got much more personal information as well. It's clearly a case where the company should be disclosing that they had a breach. If they don't, I'm going public with what I've got.
These companies have a responsibility to the people whose information they hold.
Re: (Score:3, Informative)
Re:Is it fixed? (Score:4, Interesting)
I spoke with one of their InfoSec guys on the phone. They have my phone number, and they know that I know that my personal information was compromised. There's no excuse for not keeping me apprised, at the very least.
Re: (Score:2)
Re: (Score:2)
The only responsible thing in cases like this is full disclosure. You gave them a chance to address it, now everyone else deserves to know that they are at risk.
I had a similar experience with Knet, the company that hosts my web site. I had an email from Google notifying me that a URL on my domain was being used for phishing, and sure it it served up a fake PayPal login page. I was unable to do anything about it because it was on a subdomain reserved for admin and mail handling by Knet, so I contacted them.
Re: (Score:3)
Filed, thanks very much for the link.
It's funny (in a sad way) - three or four of the initial questions in the report asked if I had contacted a credit reporting agency to let them know my data had been compromised. At the top of every list was Equifax.
And the company who was breached? The ones who leaked my SSN?
Equifax.
Re: (Score:3, Funny)
"And they may not even have any real reason to believe it happened as "some guy on facebook" says."
Nobody reads the facebook page in the company besides the marketing slime who have no clue.
And perhaps their astroturfers who post loving reviews of their product.
That's about it.
Re:Is it fixed? (Score:5, Interesting)
I'd bet my left nut "a well-known provider of tools for the Systems Administration community" is Atlassian, and they claim there's no issue.
Re: (Score:3)
Ok, I'm shocked, and now in a completely different mindspace. We've been using Jira here at work for the last few months, and since approximately that same time frame, we've been getting spam, and everyone swears to me that they never got spam before. I never linked the two in my mind, but now I'm looking into it.
Re: (Score:2)
Looking into the headers of the mails would provide enough information to reveal if the infected mails originates from the company or from another source.
Changing your mail address to another for the company may be another way around it.
Re:Is it fixed? (Score:5, Insightful)
Maybe they did fix the issue, but its difficult to take away the compromised list once someone else has it. Or were you expecting them to track down the virus senders and delete the lists from those servers?
I agree, once its out, they are as powerless as the target is.
As for his question:
What would you recommend as my next course of action?"
1) Kill the email account, such that all mail bounces.
2) Create a new subscription account.
3) Realize that you are on the internet, where not everybody plays by your rules. Install spam and virus filters, and get on with your life. You've done all that you can to help the clueless operators. Its not worth any more of your time or anguish.
Re: (Score:3)
2) Create a new subscription account.
3) Realize that you are on the internet, where not everybody plays by your rules. Install spam and virus filters, and get on with your life. You've done all that you can to help the clueless operators. Its not worth any more of your time or anguish.
Possibly skip 2) though, as "clueless operators" might not be the best choice to obtain your "tools for the Systems Administration community" from?
Re: (Score:3)
1) Kill the email account, such that all mail bounces.
No. Kill the email account, such that all mail goes to /dev/null
Don't flood the world with bounce messages. Especially if your email address is used as the 'from' address and you get 1200 bounces from other people (been there, had that).
Re: Is it fixed? (Score:2)
I'm on my third or fourth linkedin email despite having it non-visible. They never responded to any messages.
Re: (Score:2)
Exactly,
Besides most companies don't like saying what they did wrong so they probably fix the problem, then tried to keep it quiet. Being that social media now adays spreads and exadurates every bad news, there is no insentive to make their problems public, unless they really have too.
Re: (Score:2)
Well, they could at least publically acknowledge the breach...
Geeks rarely rule the roost (Score:2, Interesting)
In my experience when situations like this arise and no action is being taken leadership either doesn't understand the problem or doesn't think it important.
Re: (Score:2)
^ ^ ^ ^ This too. It's a sysadmin list, so I'd hope they understand the problem, but there are plenty of PHB that get in the way.
Re:Geeks rarely rule the roost (Score:5, Funny)
I just wonder what kind of System Administration list has a facebook page. The mind boggles.
Re: (Score:3, Funny)
One of these things is not like the other.
Re: (Score:2)
And Facebook is the primary channel today of spreading malware. Social engineering combined with trojans are quite effective.
Re: (Score:2)
Yeah, I've got a Facebook account. So what? I'd be more than happy to tell you all about the last time that I was social-engineered into doing something with a computer, but it simply hasn't ever happened.
Re: (Score:2)
What? You don't fall for "MaryJaneBarely18XXX wants to be your friend" requests? :)
Write threatening letters (Score:5, Interesting)
I'm in a similar situation: I create a unique email address for each company I deal with, and each website I register on.
The only solution I've found to be the most effective is sending these companies threatening letters. Quote them sections from their own privacy policy; usually there will be a clause about circumstances under which they will share your subscriber information. Tell them they've breached their own privacy policy, and whatever federal privacy legislation your country has in place. While you're at it, file a complaint with your country's Privacy Commissioner, or whatever the equivalent is.
Perhaps we need some sort of "name and shame" website for companies whose subscriber lists have been either breached or sold (e.g. Dell)
Re:Write threatening letters (Score:5, Interesting)
+1. You have no reason to expect an acknowledgement if you just pass it 'up the food chain'. Put it in clear legalese and look forward to a reply from their lawyer. Most likely someone on the inside sold the list for chump change.
btw did you consider that maybe it's you that's compromised? 8-)
Re: (Score:3)
btw did you consider that maybe it's you that's compromised? 8-)
If he were, then he would get the same viruspam sent to many, if not all, of his email addresses instead of just one.
Re: (Score:3)
Most likely someone on the inside sold the list for chump change.
Another possibility is one of their desktop computers got infected with malware that grabbed the Outlook global address book and email contact history and sent it back to the mothership.
These things were notorious a couple years back. If the domain does not use SPF records (and even some times if it does) using the address book for forged From addresses while sending to the addresses found in the Sent box and contact lists, it has a decent chance of hitting a white-list and getting by more spam filters tha
Re: (Score:2)
The only solution I've found to be the most effective is sending these companies threatening letters.
It could just as likely be YOUR site that was compromised, and they found the address in something they sent to you, or some key logger in a coffee shop where you logged on.
Make sure you are outside of your pristine glass house before you start throwing stones.
Re:Write threatening letters (Score:5, Insightful)
The only solution I've found to be the most effective is sending these companies threatening letters.
It could just as likely be YOUR site that was compromised, and they found the address in something they sent to you, or some key logger in a coffee shop where you logged on.
Make sure you are outside of your pristine glass house before you start throwing stones.
This is incredibly easy to check. If it was local compromise, all addresses would be compromised, not just the one assigned to a particular company. Spam and viruses should be be pouring in to many many addresses. If it was just a single address assigned to a single company then you be pretty sure that it was their system compromised and not yours.
Re: (Score:3)
There are many ways that an email address can get compromised that are not the direct fault of the company you gave it to.
Since emails are sent in plain text, over the open internet, all it takes is someone sniffing somewhere along the line and collecting email addresses.
Your original "subscription" may have been over SSL, but the subsequent emails they send out are not.
Re:Write threatening letters (Score:5, Interesting)
Re: (Score:3)
As someone who has spent his entire life working at various ISPs, the answer is "yes."
Re: (Score:2)
It could just as likely be YOUR site that was compromised, and they found the address in something they sent to you, or some key logger in a coffee shop where you logged on.
Make sure you are outside of your pristine glass house before you start throwing stones.
This is incredibly easy to check. If it was local compromise, all addresses would be compromised, not just the one assigned to a particular company. Spam and viruses should be be pouring in to many many addresses. If it was just a single address assigned to a single company then you be pretty sure that it was their system compromised and not yours.
Unless the spammers know that he knows that he only gave the address to one company, so they only used one of the many addresses they harvested to spam him, casting suspicion on that company so he wont think to check his own PC, allowing them to collect a nice list of other email addresses from people he is affiliated with. That way, they get 100 addresses from 100 people, instead of 100 addresses from one guy with his own domain. /paranoia
Or even just a polite letter, or phone call (Score:3)
Re: (Score:2)
I create unique email addresses too. I run a catch-all mailbox, so my scheme doesn't do much to prevent me getting spam. It tells me who has been compromised and I can be a good citizen and let them know. I give them one fair chance, and if they don't respond, or if they're retaliatory towards me, then feck 'em. Nobody ever gets my "real" email address. Most websites simply never respond to my information. If it's a blogger, they infrequently respond, but just to express doubt, and interrogate me about my
Re: (Score:2)
How long have you had your domain? I've had mine for 10 years now, and I get a really weird combination of addresses. They've built up slowly over time. Some of them are pretty bizarre and totally unrelated to any address I've ever used. Some appear to derive from corrupted address lists that have been copied over and over (my normal address is myname@mydomain, I regular receive stuff to: mynamemyname@mydomain, myname.mydomain@mydomain, yname@mydomain, etc.) Some appear to be guesses of address I might
Re: (Score:3)
"I create a unique email address for each company I deal with, and each website I register on."
Why on earth would someone create a mailaddress just to register to a website when mailinator with their gazillion aliases exists?
$ mysql maildb -e "INSERT INTO aliases VALUES ('mythrowawaylogin@mydomain.com', 'mylogin')"
Ah, the joys of postfix+mysql and your own domain. Someone spams you, and you don't click the unsubscribe, you just drop the alias
I even have an alias on my phone to do it for me when I'm out in meatspace.
Re: (Score:3)
"I create a unique email address for each company I deal with, and each website I register on."
Does nobody of you morons know of mailinator.com?
Why on earth would someone create a mailaddress just to register to a website when mailinator with their gazillion aliases exists?
Just give them mythrowawaylogin@mailinator.com as email address, read it _once_ to click the confirmation link and forget it.
Reason 1: there are plenty of people using services like this - http://www.block-disposable-email.com/cms/ [block-disp...-email.com]
Reason 2: I may want to establish an ongoing relationship with a company (e.g. receive newsletters, etc) rather than just have a fire & forget initial contact
Reason 3: Having email coming to my inbox is more convenient than having to open a web site to view it. (I have a regexp-based email setup that allows me to just make up addresses that match a pattern, and I can add individual addresses to my
Move On (Score:5, Insightful)
What would you recommend as my next course of action?
Nothing. Seriously. You tried, they didn't listen. Typical. Now find something more deserving of your attention to spend your time on. :)
Re: (Score:3)
Nothing. Seriously. You tried, they didn't listen. Typical. Now find someone more deserving of your business to spend your money on. :)
There, fixed that for you. =)
Depends... (Score:5, Insightful)
- Is the email address in question visible to other people? e.g. registered forum members for the software in question? Sometimes people sign up for a forum just to be able to harvest the otherwise hidden addresses of other forum members
Re:Depends... (Score:5, Interesting)
Re: (Score:3)
Re: (Score:2)
I (not the submittor) frequently use <myname>+<site name>@<mydomain>.
One of the issues with this is that <myname>@<mydomain> will be delivered, too. And, if that's your "real" e-mail address, then it's now out there for spammers to hit.
If you instead use something that doesn't rely on special address parsing (like <myname><site name>@<mydomain> or <myname>@<site name>.<mydomain>), you can just ditch the e-mail address once it is compromised. There are a couple of companies that I had to do this to simply because their "you've
Re: (Score:3)
Another problem with using "plus addressing" as I describe above is that I have come across legitimate companies who use a website for unsubscribe requests, but their website will not process the address I used.
How to unsubscribe then?
Re:Depends... (Score:4, Insightful)
- Is the email address in question visible to other people? e.g. registered forum members for the software in question? Sometimes people sign up for a forum just to be able to harvest the otherwise hidden addresses of other forum members
This is the first thing I thought of. I've seen small companies send out mass emails to blocks of people, sharing my name with the hundreds of other customers on the list. I've seen support postings with email addresses embedded as links behind the user names. Both of those are the faults of the companies that engaged in such behavior, but aren't quite the same as a "compromised" list.
Obviously, the author's intent was to leave himself in an anti-spam position, to be able to simply block the compromised address to stop further spam. I suggest he exercise that option and move on. He's notified them to the best of his ability. Further activity, such as trying to name-and-shame the company, could end up with their lawyers sending him cease-and-desist nastygrams. I'm not a lawyer so I can't tell him if those kinds of letters have legal merit, but if he has to hire a lawyer to get an answer to questions like thta, it could cost him money.
Re: (Score:2)
Many, many years ago when I got my first domain, I set up *@domain.com to forward to me. And about 5 minutes and several spams/garbage from the owner of the domain before me later, I turned it off.
However, I did end up making a subdomain and forwarding everything (*@sub.mydomain.com), and I've been using it exclusively for signing up to sites ever since (I've probably been using it for ~13 years). I can think of about two occasions where I have actually got spam to any of the addresses I used, both were fro
Public Shaming (Score:5, Interesting)
It's practically impossible to get anyone to acknowledge something like that. From their perspective they just think you are yet another ass who thinks they know more about the internet than they really do.
I don't even bother any more. I get spam/malware it goes into the block list and I don't do business with the company anymore. If you really care about it, make it public. If you have a blog make an entry about it and hope it shows up in google. Or post the info here, if it gets modded up google will probably index it.
Re: (Score:2)
I do the same thing with email and my domain name. I suspect that while sometimes the lists are being compromised, other times the companies are selling the lists to spammers for extra cash. I do address the companies when this occurs, and usually the response is something along the lines of ' you have no idea what you are talking about, spammers use random generators and word lists - your experience is likely purely coincidental' (I call total BS on this since you would clearly be receiving all kinds of
That is what I would do (Score:4)
Either way, even if the service you are hiring it is unimportant enough to allow you to live with this kind of practices, I advise you, regardless of how right you may be about their problems, to stop wasting your time trying to help those that are not interested in being helped.
Compromised, all hope is lost... (Score:2)
If you've let them know, and they ignore it, there's nothing you can do. You can't make anyone do anything.
You could publicly shame them. That runs the risk of lawsuits, and possibly being pointed to as the intruder.
All you should really do is unsubscribe from the list, and block any email coming in to that account. Unsubscribing won't stop the viruses, as the intruder as almost definitely fed it to their botnet. It may only (hopefully) keep you from being
Once You Eliminate The Impossible... (Score:4, Interesting)
Once you eliminate the impossible, whatever remains, no matter how improbable, must be the truth.
-Arthur Conan Doyle
Have you considered the probability that perhaps they meant to send you a virus? What sort of tools are these? The system administration tools, I mean, not the people who can't properly administer their systems but expect to help you administer yours.
You're not helping, honestly (Score:5, Insightful)
Even if they know the list is "compromised", what are they supposed to do about it? It's already out there. Do you expect them to go after the spammers? Because that's essentially impossible. If they're not in the United States, it really *is* impossible.
That's why you haven't got a response. They know, but there's nothing they can do.
And frankly, if you had decent spam filters on your own personal domain, you probably wouldn't be seeing these emails anyway. I doubt anyone with a Gmail or Yahoo or Outlook.com address sees this stuff.
My suggestions? Quit worrying about it, and quit running your own mail server. You may think you know what you are doing, but you almost certainly don't.
Re:You're not helping, honestly (Score:5, Insightful)
Even if they know the list is "compromised", what are they supposed to do about it? It's already out there. Do you expect them to go after the spammers? Because that's essentially impossible. If they're not in the United States, it really *is* impossible.
That's why you haven't got a response. They know, but there's nothing they can do.
And frankly, if you had decent spam filters on your own personal domain, you probably wouldn't be seeing these emails anyway. I doubt anyone with a Gmail or Yahoo or Outlook.com address sees this stuff.
My suggestions? Quit worrying about it, and quit running your own mail server. You may think you know what you are doing, but you almost certainly don't.
Disclosing the data breach to everyone affected would be nice (and in some states is legally required), as well as letting customers know what data was breached..
Of course, this assumes that they actually know how the data leaked and which customers were affected and they probably don't.
Re:You're not helping, honestly (Score:4, Insightful)
Even if they know the list is "compromised", what are they supposed to do about it? It's already out there. Do you expect them to go after the spammers?
I expect them to plug the hole.
A compromised system is not a one-shot embarrassment. If you don't plug the hole, whoever compromised the system the first time will keep coming back for more data or will expand the breach to other systems.
1) If it an external breach, I expect back doors to be closed, vulnerabilities patched, account passwords changed, etc. This won't likely happen overnight but simply knowing that there is a breach and what kind of a data is stolen is big help providing the admins get their heads out the sand and acknowledge that there is a problem.
2) If it an unauthorized inside job, I expect the perpetrator to eventually be found and fired for cause with at least the possibility of criminal prosecution.
3) If it is an authorized inside job, I want the practice stopped permanently and I hope to see whoever approved the policy removed.
Unfortunately, all these require work and significant risk. The easiest "solution" is to deny there is a problem and, if necessary,blame the person reporting the issue. The vast majority of people, completely ignorant on how spammers harvest address and completely dependent on services like Google to filter out the bad and not lose to much of the good are not the wiser.
Re: (Score:2)
And frankly, if you had decent spam filters on your own personal domain, you probably wouldn't be seeing these emails anyway. I doubt anyone with a Gmail or Yahoo or Outlook.com address sees this stuff.
My suggestions? Quit worrying about it, and quit running your own mail server. You may think you know what you are doing, but you almost certainly don't.
Being aware of attempts to get past your security is a sign of incompetence?
Compromised, you sure? (Score:5, Insightful)
Or they knowingly sold your address.
Use This Thunderbird Plugin (Score:5, Informative)
This does not directly address the question, but it is topical.
I do the same thing with my domain and it was always a hassle to make sure I filled in the correct From: address on each email I sent. Then I found the Virtual Identity Plugin [absorb.it] for thunderbird.
It automagically remembers what From: address to use with what To: address. It also makes the From: line fully editable on the fly and remembers what you used for the next time. It makes it dead simple to make sure that you never accidentally leak one of your unique addresses to the wrong person/company.
Re: (Score:2)
How does that work when you send e-mail from half a dozen different systems, including Outlook, pine, Android mail, sendmail, and in a pinch, even telnet to port 25 or openssl to port 465/587?
Solutions that require a particular piece of software aren't. They're short-lived workarounds at best, and fetters you at worst.
Re: (Score:3, Insightful)
How does that work when you send e-mail from half a dozen different systems, including Outlook, pine, Android mail, sendmail, and in a pinch, even telnet to port 25 or openssl to port 465/587?
You made your bed, now sleep in it.
Re: (Score:2)
How does that work when you send e-mail from half a dozen different systems, including Outlook, pine, Android mail, sendmail, and in a pinch, even telnet to port 25 or openssl to port 465/587?
These are one-off addresses tied to each company and are used for preventing spam to a personal e-mail address, and most of them aren't ever used to send e-mail. The few times you need to, it's also usually not critical that the e-mail be answered right now (unlike a business e-mail), so you can wait a bit until you are at one of your machines with the correct software (because you aren't going to be doing this from random machines, ever, as it's still your personal e-mail).
If you are really desperate, tho
They May Not Know (Score:2)
It's possible the list was snagged by a disgruntled (or ex) employee who sold the list. The Powers That Be may not believe the list has been compromised. A few back channel comments and/or a FB isn't actionable proof.
I'd post to their support email line (I'm assuming they have one?) and provide the unique email address you used. Provide more detail than this post. Then if they still ignore, share it on publicly as a public service to their other customers.
I had a friend that was in a similar situation. A co
Another possibility (Score:2)
Is it at all possible that you're the one who was cracked, and that's how the email address got into the wild?
good luck with that (Score:2)
I've been doing that for more than ten years and I've never gotten a satisfactory response. Somebody will give your carefully-crafted letter fifteen seconds of thought and send you a form letter about phishing or clicking on sketchy links or whatever. They don't understand the dedicated email thing, or that they have a problem. So, you gave your explanation to some geeks you think will "get it", but ultimately they'll have to tell some non-geeks about it, and they'll give it fifteen seconds of consideration
Too much bother (Score:2)
Same situation here with individual email addresses per recipient.
If it's SPAM - report to Spamcop. After 3 SPAM's change address of individual addressee or disable it if it's older than 3 years and not used since.
The interesting part with this game is to see how many users are putting plain email addresses in CC, so when one of the many gets compromised, everyone else on that header gets spammed.
Did you? (Score:2)
Hi, I run my own mail domain to.
I would have re-audited my system and made really sure the leak did not come from a different attack vector before pinpointing them.
Did you parse the headers of the spam to get more clues?
Most companies won't spend time because another network administrator tells them they have something wrong. Rule one is always to prove your facts almost without a doubt otherwise they may not listen to you or take action.
Try creating another account from a clean install to see if same happe
Another possibility. (Score:2)
Re: (Score:3)
People keep suggesting this, but time and again we find that the reason that highly specific tagged addresses are getting spammed is that someone leaked or compromised a list.
Re: (Score:2)
They didn't suffer a breach buddy ... (Score:2)
The list was sold. Yes, it happens more often than you think. If the company itself didn't sell it, then somebody on the inside made an extra buck. That's why nobody will acknowledge your complaint.
here's one way. (Score:2)
simple, use the compromised list to email them telling them so.
Where do you think spammers get their lists? (Score:2)
First off if you are bothering to create separate email accounts for each site you know full well the risks of giving anyone your email address. How do you think spammers get everyones email addresses? Tooth fairy?
Secondly jumping to conclusions is ususally not prudent. "knew immediately that either their systems or their subscriber list had been compromised"
For all we know your system could be hacked and you just don't know it or you've got a directory server or vrfy enabled and the account was brute fo
I don't think you do... (Score:2)
I used to be a member of a professional society. I started getting spam to the unique, tagged, address I'd used to register with them. I pointed this out on a mailing list. I got threatening notes from them about how they didn't appreciate me implying that they had sold addresses or been compromised...
Blizzard ignored queries from me about the sudden appearance of spam (from their servers, even) to unique, tagged, addresses. A week after they blew me off, there was an announcement that they'd been compromis
Happened with Star Trek Online (Score:2)
Are you sure it's compromised? (Score:2)
My personal guess was that these morons must have sold their list to somebody (or cross-marketed, or whatever other stupid idea one of their coked-up marketing exec came up with) who in turn sold it and so on, all the way to the darker recesses of the internets. A chain is only as weak as its weakest leak, so once the
Knowing the right channel (Score:2)
First of, I hold the idea, that the list was sold, very likely. They will never admit to that. You might want to check their privacy statement and take actions according to that (see post by nemesisrocks).
But for a self confessed geek with his/her own email domain, the OP shows shows an alarming lack of knowing the proper channels.
This is a problem with email, so maybe the OP should have send a mail to 'abuse@company.com' or even 'postmaster@company.com'. Not place something on the facebook page, that only
Starbucks is also guilty (Score:2)
I created a special email address for Starbucks several years ago, starbucks@mydomain.com, and I started getting spam on it within weeks after giving it to them. And this wasn't just "legitimate" third party spam, but was penis enlargement type spam. I set a gmail filter to always trash anything coming to that address, and every time I check the trash there are still a bunch of spam emails coming in to that address. So I don't know whether Starbucks sold the address to a third party who may or may not have
Don't buy their anti-virus products! (Score:2)
Considerations for jetkins (Score:2)
First, no news is good news.
Second, You are already on that spammers list. You shouldn't expect to suddenly stop receiving spam.
Third, here are two tests to consider to take away any doubts.
1) Rule out man in the middle attack.
Its very possible for your (or any intermediate) machine to be infected and passed along your keystrokes or detected email addresses in network packets.
If you could setup a scenario where this is ruled out. Register on a different (clean) machine, using a different email address, poss
Common (Score:2)
When I have reported this, every time I was told that it was my problem, that I had a virus, or that I was an idiot/a troll/etc. Never did anyone take any responsibility or take any action.
Full Disclosure (Score:3)
Passing something "up the chain" is a sure fire way to ensure it gets lost. And notifying a company behind-the-scenes of a security issue has a success rate so low, it could still legally drive.
It's good to give them the chance. Once. With a short time for a reply. Make sure your tell them you expect a reply until (insert date). If they don't reply, or bullshit you, go full disclosure with names and details. Bad publicity is about the only thing you can create that gets a company into motion.
If there is applicable legislation and an official you can contact, do that as well. Many states and countries require companies to disclose known data breaches.
Is your mail hosted at Network Solutions? (Score:2)
Is your mail hosted at Network Solutions?
If so, I have a friend in the same boat. They've recently switched their cheapest hosting solution to no longer filter SPAM; in order to get SPAM filtering, you have to "upgrade" to a more expensive hosting solution. They've decided that they can monetize SPAM filtering, and so they've discontinued it from the cheap accounts to incentivize you to upgrade to a more expensive account - or just switch providers to one that SPAM filters, but they figure you won't do th
Levels of escalation (Score:2)
1. Open up the compromizing email's headers. Locate the first ISP beyond yours -- 99% of the time it's not there's. Contact THAT company.
2. File a complaint with the FCC. They are getting more active against exploits.
3. Locate your Attorney General's office and ask if there are any state laws against spam. There is one in Maryland that is compatible with CAN SPAM, and has been tested in the courts. If you got one, lawyer up and sue the company -- some companies only respond by judicial inquiry.
4. B
Re: (Score:2)
Sure ? (Score:2)
The address is now known by bad guys. You can not know whether the site has corrected its problem or not if you have not changed your email in your profile and the new address is spammed.
Spamex (Score:2)
I use Spamex [spamex.com] to create DEAs (Disposable Email Address).
I have been surprised when these get compromised. The biggest surprise was one for the New York Times.
I let folks know, then just turn off the snagged address.
This is a very different world from when I first started using email in the early 1980s (not Internet Email, host-based and proprietary). It comes with the territory, and I have to accept it.
Re: (Score:2)
Trivially easy to canonicalize that to YourName@gmail.com, and since that approach is so well-known, any competent spammer (not a self-contradiction, nice though it would be; there's a lot of money to be made) will be able to strip such "custom" addresses to the real address. If you want this approach to actually work, you need to blacklist the root address (yourname@) using filters (I'm assuming Gmail filters cna handle that) and only accept mail that has the identifying tag.
Re: (Score:2)
I have to ask.....why do you care? It's not your problem.
Maybe he's slightly control freak and would desperately want to get that problem fixed behind the scenes in their systems.
Re: (Score:2)