Spam from "GSN" to e-mail address registered on Play.com

halfer

bri22 wrote: »

Is it advisable to change both email and password at Play.com after this incident?

Yes to the password, as it's easy to do.

I've changed my email address too, but then it's easy for me; I have a domain and so can just set up a new email address. If you rely on a single free account, or one at work, then it is much more of a pain and probably not worth the bother.

bri22 wrote: »

Edit: Also can it be near enough be confirmed now or not that it was only the email addresses that had been stolen? Or are there still suspicions?

Well, it depends on who you ask

Play say it was only "emails and names", and then later "just emails". However if the marketing company held more data about users than just this two pieces, you might assume that it would all be stored in the same database, and a miscreant wanting to steal the data would just take the whole lot.

bri22

halfer wrote: »

Yes to the password, as it's easy to do.

I've changed my email address too, but then it's easy for me; I have a domain and so can just set up a new email address. If you rely on a single free account, or one at work, then it is much more of a pain and probably not worth the bother.

Hi thanks for the reply

Just so im clear about things, as well as changing my play.com password should i change the password to the email that is assigned to my play account?

Regarding the email, I use a single free account, so just to be on the safe side i think i may just create a new hotmail account and assign it to play.com.

halfer wrote: »

Well, it depends on who you ask

Play say it was only "emails and names", and then later "just emails". However if the marketing company held more data about users than just this two pieces, you might assume that it would all be stored in the same database, and a miscreant wanting to steal the data would just take the whole lot.

After browsing this thread and reading what various people have stated, it seems as though you cannot delete your card details, would it be possible to edit in fake ones? Not sure i want to continue with play.com after this.....or am i overly worrying about this incident?

Sorry for the numerous questions,

Thanks again for the reply.

halfer

bri22 wrote: »

Just so im clear about things, as well as changing my play.com password should i change the password to the email that is assigned to my play account?

I'd say that's not necessary, so long as it's not a guessable password; the security of your email provider is not in question as a result of this data leak, but if you have a free email account with a password of "password", then yes, change it now . (My strategy is to think of a song lyric I like, and use the initials of the words in that lyric, around 8-10 characters. Very unguessable and quite memorable.)

bri22 wrote: »

Regarding the email, I use a single free account, so just to be on the safe side i think i may just create a new hotmail account and assign it to play.com.

You can do, but it's the checking it separately that's a pain. However I believe you can set one account in Hotmail to auto-forward to another - if so, that will solve the problem very nicely indeed. (If the throwaway address gets discovered by spammers, turn off the auto-forwarder, close the account and open a new one).

bri22

Ta mate, very much appreciated

p926

When I realized on Sunday, I took the precaution of cancelling my credit card, so the details Play hold are no longer valid.

But Play are not the only company I have caught using a unique email address. EDF energy, aememory, and Naxos all appear to be guilty too. Fortunately, none of my credit card details were held by these companies. So far, aememory don't appear to be taking me seriously. I have yet to hear from Naxos; and I didn't bother to try and communicate with EDF energy. I suppose the evidence of just one person is not sufficient, so well done this forum!

It seems data leaks like this are becoming more and more common...

mr_fishbulb

Pound wrote: »

The security breach seems like nothing compared to experiences I've had with some companies. Some companies have read my address and date of birth over the phone after asking for nothing more than a username. One even told me my password.

One changed my password for me using their online help chat. I couldn't log in, and had no idea what my password was. They just wanted my username to do so. Told me my new password over the chat!

halfer

Well, play.com's "response" has been rubbish - I was rather hoping they'd fix their credit card system so cards can be removed.

Anyway, today I received an item of spam to an email address that only amazon.co.uk knew about - so I have fired off the customary email to find out what data might have leaked. My account salutation (set as just my first name) definitely leaked as well, as this made up the email title. I will update here if Amazon 'fess up to anything.

[Maybe the loud whirring I can hear is the sound of a PR machine starting up already? ]

GustyGardenGalaxy

I haven't ordered anything from play.com since the problem started, and have no intention of using them again.

What has also annoyed me is that they never bothered to reply to my two emails regarding deleting my account.

halfer

Hey ho, I'm having no joy with Amazon. Either they're just using cut-n-paste answers, or they've not understood that the email address I use with them has only ever been used at their store.

Though their consistent lack of acknowledgement that a leak appears to have occurred is quite annoying, I had better not say anything too mean about them, since I've sent them the URI to this thread

johnnyboyrebel

Just a thought but have any of you guys ever bought from a playtrade seller on play.com? That may be much more likely to be the source of spam as Obviously they will harvest your email addresses too.

I'm also convinced that you can delete your play account altogether yourself so you could just set up next time you order if youre not a regular play shopper.