Spam from "GSN" to e-mail address registered on Play.com

butters_2

j2g wrote: »

1. We don't email users who have opted out because thats what spammers do.
2. Our data got compromised by spammers who spammed our entire database.
3. We want to notify every one who got spammed and apologies (which would be a "spam" email).
4. But to do so would make us as bad as the spammers... argh.
5. Lets just email everyone we can and hope for the best. Two wrongs don't make a right... etc..

Hope this helps put some peoples minds at rest... or maybe just confuses people.

Thanks for the insight, good post. A worrying matter is why people who are opted out are having their details passed on, the opt out specifically mentioned passing on details to 3rd parties. Whether or not they we are marked as opted out is irrelevant, opted out people's names should not have ever left play.com as that is the whole point of opting out.

Personally I call shenanigans, I think it is Play's own security has been breached by an employee or outside source and they are conventionally laying the blame on 'evil marketers' who are an easy scapegoat, considering the contradictions coming from Play.com I doubt even they know what's going on!

EDIT: looking at the comments on their facebook page it seems the majority of Play.com customers have been pacified by the apology :wall:

Pound

There's about a dozen well known companies that have leaked my email address. I email them and complain and they don't reply. If I change my email address I start eventually getting spam to the new address.

This has been happening for years

oiuytrdes

lionheart79 wrote: »

The following sentence is irrelevant, That all said, a few more junk emails to my account that already gets dozens a day isn't the end of the world. I shall continue to do business with them where the deals are worthwhile.

And with an attitude like that, you can guarantee that going into the future businesses will continue to try and make a buck off our privacy.

Play might have thought it was cheaper to outsource their spamming, or the spammers paid to get at the addresses, or Play are another company that ultimately treats its staff like !!!! and one of them took copies of the data. When there are always unemployed people (even during economic good times), companies are able to keep salaries down and get away treating people like crap. Respect is a two way street, and if businesses respect their employees, both through treatment in the workplace and pay, unauthorised data access is less likely to lead to situations like Play is facing now.

And from me I am thinking of taking legal action and seeking compensation. I have not used Play for a long time, since their service turned to !!!!, and for some reason a few years ago I contacted them and told them to delete my account, personal data, sales records, etc., everything from all their systems, offices, and record storage. The reason I contacted them was probably due to receiving some spam from them, so I decided then I didn't want anything more to do with them. Telling them to delete my account (and wipe my personal data from back up tapes, all workstations in the company, etc.) will cost them massive amounts of time, and so makes their spamming uneconomical. Or that was the hope.

Play didn't delete my account! I found out months later when I was able to log in. I didn't do anything about it though. Yet still now, my account works. I can see I haven't used it for several years now, but there is still personal data saved that I told them to delete.

That is a criminal act, right? How can I remind them of that, and ask for compensation, without sounding like I am blackmailing them? Just tell them I am going to seek formal legal advice about the situation, I am writing to them "without prejudice"?

I !!!!ing hate spammers, and companies that sit on data are exactly the same. You think Tesco want the data they glean to make your shop easier or quicker? No, they want it to convince you to hand over more money than you otherwise might want to. And if that means you get into debt, well, they'll give you a loan!

You can bet that big data-rapists like Tesco or Google lobby hard against legislation like the data protection act, and eventually it will get removed. And if it isn't replaced by tougher legislation then the data-rapists will step into action, pool their knowledge, and the targeting of the spam will become more precise and more convincing over night.

I do not want to be part of that and do not want it to go on. So I do my bit to utterly frustrate data-rapists, and hopefully organisations will start to actually respect privacy!

GustyGardenGalaxy

Well said. I also enquired about account deletion, but no reply yet (that was two days ago).

It's OUR private data that they have, and we have a right to having it removed immediately on demand.

halfer

@oiuytrdes, I think you're right that people need to vote with their feet i.e. if a company is careless with customer data, they go elsewhere. But I wouldn't ask them for compensation without taking advice first - they will probably try to ignore you. I think you'd also need to prove damage as well, and if it's just your email address, you'd either need to have received a bucket-load of spam, or suffered some distress at invasion of privacy. The latter is possible, I suppose, but difficult to prove (and I am not a lawyer!).

I'm not defending play.com here, but it is good that only email addresses leaked, and afaik there is no other security problems. Don't forget this is a huge PR disaster for Play as well, and Amazon may well be able to poach some otherwise loyal customers. So Play have already had their punishment, in a way.

I've mentioned a few things earlier in the thread that Play could do to make amends, and if they do something, I'll stick with them. Meanwhile to protect yourself, get yourself a domain email account - it's very cheap and easy to do - and use a different email address per provider.

Aside: one day, we'll start doing the email trick with telephone numbers too. Each person will have 50 or so numbers, and we'll be able to give them out to each provider, and easily find out who is leaking our data, or disabling a number and creating another one if it falls into the hands of cold-callers.

capate

halfer wrote: »

I'm not defending play.com here, but it is good that only email addresses leaked,...

At this stage, I wouldn’t be absolutely confident of that!
I’ve not read anything that categorically states that ‘Silverpop’ is the exposure point. What I’ve read is *believe*, *maybe* and *no evidence*.

However, if it was ‘Silverpop’, apparently:
“...Silverpop handle all email data held by Play.com, and are responsible for all email services, including marketing subscriptions, unsubscribing services, orders, fulfilment and anything else associated with email services. Email addresses would be held by them in order to process and fulfil orders, even if the customer had 'unsubscribed' from receiving marketing emails from them...”

‘Order’ confirmation emails I receive from play.com contain my *name* and *home address*

halfer

@capate, hmm, a valid point (edit: that Silverpop handles more than email addresses) - I'd not seen that. At the moment, I'm happy to see what comes out of the UK Information Commissioner's investigation. But, needless to say, if play.com is actively misleading about the leak, I'll make a formal complaint to the relevant IC and will encourage everyone else affected to as well.

Edit: I think one of the articles (Independent?) did say that it was Silverpop, as did a statement from play earlier in this thread. I'd doubt they'd get away with saying that if Silverpop were not at fault - it would be libellous if so.

Pound

The security breach seems like nothing compared to experiences I've had with some companies. Some companies have read my address and date of birth over the phone after asking for nothing more than a username. One even told me my password.

Equaliser123

Pound wrote: »

The security breach seems like nothing compared to experiences I've had with some companies. Some companies have read my address and date of birth over the phone after asking for nothing more than a username. One even told me my password.

Does that excuse this????

bri22

Hi all,

Is it advisable to change both email and password at Play.com after this incident?

Edit: Also can it be near enough be confirmed now or not that it was only the email addresses that had been stolen? Or are there still suspicions?

Thanks