M&S tells customers a third party may have email details and names of there customers

trinidadone

I received this email from M&S today:

We have been informed by Epsilon, a company we use to send emails to our customers, that some M&S customer email addresses have been accessed without authorisation.

We would like to reassure you that the only information that may have been accessed is your name and email address. No other personal information, such as your account details, has been accessed or is at risk.

We wanted to bring this to your attention as it is possible that you may receive spam email messages as a result. We apologise for any inconvenience this may cause you. We take your privacy very seriously, and we will continue to work diligently to protect your personal information.

Marks and Spencer plc. Registered office: Waterside House, 35 North Wharf Road, London W2 1NW.
Registered number: 214436 (England and Wales)

Should I be concerned about this??

fluffnutter

Not really. Your email address is probably far less secure than you imagine. At least they're telling you so you can be extra vigilant for a while.

uk-tyler

Just what I need, more spam.

I've managed to keep my email pretty much spam free, I dislike using filters because they can block emails I want to receive.

You would think that a company like M&S would be more secure. I've contacted them today to cancel my account.

So I get an inbox full of rubbish I don't want, an insincere apology and this:

We take your privacy very seriously, and we will continue to work diligently to protect your personal information.

A little late don't you think?

beverleyhills

It is Epsilon, a Dallas based email marketing firm that has been hacked. It helps companies manage their email accounts.

dealer_wins

Every day I read about companies losing customers private data.

A £1000 fine for each customer breach would focus their minds and stop this !!!!!!.

fluffnutter

uk-tyler wrote: »

Just what I need, more spam.

I've managed to keep my email pretty much spam free, I dislike using filters because they can block emails I want to receive.

You would think that a company like M&S would be more secure. I've contacted them today to cancel my account.

So I get an inbox full of rubbish I don't want, an insincere apology and this:

We take your privacy very seriously, and we will continue to work diligently to protect your personal information.

A little late don't you think?

Possibly, but data breaches occur despite the best efforts of companies and individuals to protect data. If third party software has been hacked, then, TBH, there's little that M&S could have done. These are simply the risks that online activity is exposed to.

Have you got an 'inbox full of rubbish'? Why is their apology insincere? I expect they do take privacy seriously - as the data controller they're legally bound by the DPA to manage and hold data in a particular way. Clearly someone like M&S, i.e. a retail outfit as opposed to data control centre, will outsource this to a third party. They'll have followed due process in choosing this service and will have been confident that all necessary measures are in place to protect against data breaches. But hacking is always a risk.

It's your choice of course, but to cancel your account seems a little churlish, not to mention fairly pointless. It's generally the case, as well, that directly after a security breach, a company is probably as safe as it ever will be!

PZH

uk-tyler wrote: »

...I've contacted them today to cancel my account.

So I get an inbox full of rubbish I don't want, an insincere apology and this:

We take your privacy very seriously, and we will continue to work diligently to protect your personal information.

A little late don't you think?

For heavens sake... it's only an email address - just update your spam filter. At least M&S advised you of the issue.

EDIT: I think fluffnutter above was a bit more gentle with the response

dealer_wins wrote: »

...A £1000 fine for each customer breach would focus their minds and stop this !!!!!!.

No, it really wouldn't. All it would do is force companies back to paperwork and abandon online shopping entirely.


Annoying though it is, we live in a fast paced, very technical orientated world.

Hackers will ALWAYS get past even the most stringent security given a sustained attack. Even the CIA got there servers hacked by an english bloke in a back room looking for UFO data...

fluffnutter

dealer_wins wrote: »

Every day I read about companies losing customers private data.

A £1000 fine for each customer breach would focus their minds and stop this !!!!!!.

'Every day'? Really? And I think that companies are very 'focused' on data privacy. In my company a data security breach would incur a fine of £250,000.00! I think your one thousand's a bit low, frankly :rotfl:

uk-tyler

phoodless wrote: »

For heavens sake... it's only an email address - just update your spam filter. At least M&S advised you of the issue.

Its not just an email address, its the same address I've been using for years, so many people I've lost contact with will still have it to get in touch in the future.

I don't get a lot of spam in it, but it seems to be getting worse.

I don't want a spam filter, because it catches some of the emails I want to see.

If M&S use a company that can lose my email, what is happening with my card details on their other system?

I don't think closing my account is churlish, I think its prudent. After all they have proved their systems are not secure.

vuvuzela

uk-tyler wrote: »

Its not just an email address, its the same address I've been using for years, so many people I've lost contact with will still have it to get in touch in the future.

I don't get a lot of spam in it, but it seems to be getting worse.

I don't want a spam filter, because it catches some of the emails I want to see.

If M&S use a company that can lose my email, what is happening with my card details on their other system?

I don't think closing my account is churlish, I think its prudent. After all they have proved their systems are not secure.

You are over-reacting IMO.
M&S systems have not had a problem, an external partner who only uses a list of names and email addresses has. Worrying about your card details is over the top.

System

I got the same email from the Marriot Hotel group saying that Epsilon has been hacked and my email address may be in the hands of a 3rd party. I think any company that uses Epsilon has the same problem. I don't think M & S can be blamed for this at all.