Spam from "GSN" to e-mail address registered on Play.com

Equaliser123

Gordon861 wrote: »

From The Independant
http://blogs.independent.co.uk/2011/03/22/play-com-accounts-compromised-by-security-breach/#



I bolded the important bits.

I think the other important bits are :

" He said that an investigation undertaken at the time suggested that no email addresses had been compromised. That has been subsequently proven incorrect."

"Internet security firm Sophos is warning customers that, while Play.com say no credit card information has been stolen, “it is wise to keep your eye on your credit card transactions to ensure there is nothing amiss”."

"In a blogpost, the firm told users to “consider changing their Play.com password and the associated email account password.” They also advised Play.com customers to use different passwords for different online accounts and not to open suspicious-looking emails. "

So to my mind it seems that Play.com have lost a huge amount of credibility and are doing very little to assure anyone.

halfer

Aha, thanks for that - the weak link in the chain is named. Looks like several sites' users were grabbed at the same time:

cyberinsecure.com/deviantart-members-emails-leaked-by-marketing-partner-silverpop-systems/

DeviantArt quit using SilverPop over this, I wonder if play.com will as well?

What is annoying is that play.com didn't come clean about this at the time. Had it been operating in California, US, it would have had a legal obligation to, afaik.

Play.com_Company_Representative

Message from Play.com CEO John Perkins

Dear Customer,

As a follow up to the email we sent you last night, I would like to give you some further details. On Sunday the 20th of March some customers reported receiving a spam email to email addresses they only use for Play.com. We reacted immediately by informing all our customers of this potential security breach in order for them to take the necessary precautionary steps.

We believe this issue maybe related to some irregular activity that was identified in December 2010 at our email service provider, Silverpop. Investigations at the time showed no evidence that any of our customer email addresses had been downloaded. We would like to assure all our customers that the only information communicated to our email service provider was email addresses. Play.com have taken all the necessary steps with Silverpop to ensure a security breach of this nature does not happen again.

We would also like to reassure our customers that all other personal information (i.e. credit cards, addresses , passwords, etc.) are kept in the very secure Play.com environment. Play.com has one of the most stringent internal standards of e-commerce security in the industry. This is audited and tested several times a year by leading internet security companies to ensure this high level of security is maintained. On behalf of Play.com, I would like to once again apologise to our customers for any inconvenience due to a potential increase in spam that may be caused by this issue .

Equaliser123

Play.com_Company_Representative wrote: »

Message from Play.com CEO John Perkins

Dear Customer,

As a follow up to the email we sent you last night, I would like to give you some further details. On Sunday the 20th of March some customers reported receiving a spam email to email addresses they only use for Play.com. We reacted immediately by informing all our customers of this potential security breach in order for them to take the necessary precautionary steps.

We believe this issue maybe related to some irregular activity that was identified in December 2010 at our email service provider, Silverpop. Investigations at the time showed no evidence that any of our customer email addresses had been downloaded. We would like to assure all our customers that the only information communicated to our email service provider was email addresses. Play.com have taken all the necessary steps with Silverpop to ensure a security breach of this nature does not happen again.

We would also like to reassure our customers that all other personal information (i.e. credit cards, addresses , passwords, etc.) are kept in the very secure Play.com environment. Play.com has one of the most stringent internal standards of e-commerce security in the industry. This is audited and tested several times a year by leading internet security companies to ensure this high level of security is maintained. On behalf of Play.com, I would like to once again apologise to our customers for any inconvenience due to a potential increase in spam that may be caused by this issue .

Next time it would be useful if, instead of allowing people to speculate, you would actually provide more detail rather than the slopey shouldered non-information which was emailed previously.

GustyGardenGalaxy

Well said. The information from play.com has been shoddy to say the least, and getting information from them has been difficult to put it mildly.

They have assured us that 'only' email addresses and names have fallen into the wrong hands, yet apparently when this happened (back in December, which I wasn't even aware of) they said that no email addresses had been leaked .........

So, play.com - would you care to swear on your granny's grave that NO ADDRESSES, CARD DETAILS, ETC HAVE FALLEN INTO THE WRONG HANDS?

And does this 'leak' also affect people who use playusa.com ?

halfer

Hi Play Rep,

Thanks for being here to answer concerns.

I emailed [EMAIL="privacy@play.com"]privacy@play.com[/EMAIL] on Sunday for more info, and having not heard anything, again today. Since the spam incident, I've not received an email from your firm. I am guessing therefore that not all customers affected by this have been emailed.

I've asked in my email for an easy way to remove credit card info from your database, as your user interface doesn't presently permit that. I appreciate credit card data has not leaked, but nevertheless, I've seen other retailers offer this, and it does permit the customer to control the storage of this sensitive data.

Would you find out whether this would be considered? Thanks.

Lip_Stick

Hmm.. I haven't had any spam or an email advising me about the security breach. I don't get the newsletter though.

halfer

GustyGardenGalaxy wrote: »

So, play.com - would you care to swear on your granny's grave that NO ADDRESSES, CARD DETAILS, ETC HAVE FALLEN INTO THE WRONG HANDS?

I think that's been answered by the item above. Sure, I'd also rather have heard about the breach in December, but we are where we are.

Equaliser123

halfer wrote: »

I think that's been answered by the item above. Sure, I'd also rather have heard about the breach in December, but we are where we are.

I think the point is that their credibility can be seriously called into question.

paddyrg

We recently had something similar here, on this site. Big difference is that this site was very open about what had happenned, kept us informed of the steps being taken, etc. I know Play have lost my business by trying to 'spin' this - if you can't apologise honestly and take it on the chin, why should anyone trust you?