Santander data leak or address book assault ? AKA Direct Debiting Seminar Invite.

gjchester

The problem is Email is like a post card, its not encrypted and the details can be read anywhere on the line by anyone.

Santander could have leaked it, a marketing partner could have leaked it, or any server that the email was routed through may have simply copied the headers.

The economics of spam and more likely malware (as in the tax email its often ZeuS, or Zbot malware) means you can send it to billions of email address not caring if they are valid. It only take a few people to fall for it to make it viable.

Work outsources email to Microsoft, they block millions of messages a month, both spam and Malware.

I'm not saying it may not be a breech by Santander, but there are many ways to harvest email without a organisation losing data files directly.




Post #45 could be seen as trying to educate customers, I've had similar from Halifax who's my main bank and my card company, although not from Santander who hold the household account...

quaybab

In a recent BBC report, Aviva insurance took over 3 years to admit theft of data by an employee that was sold on, despite denials.

In complaint no. 2 of mine, Santander says no so go straight to ICO, do not collect £150 though :-(
I'll take this one to the FOS via s a simple communique to get a case number and then sit on it until the bank eventually own up, keeping to the 6 month time limit.

innovate

quaybab wrote: »

In a recent BBC report, Aviva insurance took over 3 years to admit theft of data by an employee that was sold on, despite denials.

In complaint no. 2 of mine, Santander says no so go straight to ICO, do not collect £150 though :-(
I'll take this one to the FOS via s a simple communique to get a case number and then sit on it until the bank eventually own up, keeping to the 6 month time limit.

What 6 month time limit?

cowbutt

I've just had my first 'HMRC Revenue&Customs' tax refund phish to an alias only used with Alliance & Leicester from 2005 (A&L were taken over by Santander, of course). I also got similar phish addressed to aliases I've used for PGP keys and on USENET (these have been consistently spammed for years).

I've not reported it to Santander, but from this, it looks like there's little point if they refuse to acknowledge the problem is at their end.

SpamSufferer

I don't know if the followers of this thread have seen the latest news about this story at "The Register" (can't post a link as a new user :mad:) "ICO decides against probe of Santander email spam scammers". Not enough evidence apparently.

I too have received the spam e-mails to an address used only for Santander banking. I am now getting about a dozen a day but they are refused delivery so the only worry I have is where they got my address from.

I count 25 people posting to this thread who have unique e-mail addresses for Santander which have received SPAM (quaybab, dtaylor84, yangptangkipperbang, squeeks, autolycus, bubieyehyeh, username, Stompa, Lomcevak, anamenottaken, Wood Dragon, MrA2012, Pound, jamesd, LardyCake, humptydumpty123, spatchcock, mynewaccount, itsbeenawhile, Funkyfreddy, Chris2000, bonzer, handsoff, fandango99, cowbutt).

Perhaps todays news article will prompt a few more to report it here - I don't know how many ICO and Santander need before they take it seriously.

poppy10_2

SpamSufferer wrote: »

I don't know if the followers of this thread have seen the latest news about this story at "The Register" (can't post a link as a new user :mad:) "ICO decides against probe of Santander email spam scammers".

http://www.theregister.co.uk/2014/03/21/santander_email_spam_mystery/

quaybab

When the bank and the real leaker, Marketing Source Ltd (them who send you the annoying helping you stay safe online marketing rubbish from Santander) are pressed, surprisingly neither company want to engage or cough.
I don't know how many complaints the information commissioner has to get in order for them to stop saying there is no proof either company screwed up.
Regulatory action is undertaken in confidence so no one will find out about the result of this until it is concluded.

Archi_Bald

quaybab wrote: »

I don't know how many complaints the information commissioner has to get in order for them to stop saying there is no proof either company screwed up.

Unless at least one of complainants has proof that one or the other company screwed up, the number of complainants is irrelevant. The proof would need to stand up in Court, rather than being an assertion on an internet site.

quaybab

Next complaint to the ICO says Santander has breached DPA but no action on this occasion (even thought it was Marketing Source Ltd who leaked)???
Seems that presented with identical circumstances, the outcome can vary with the ICO just sending alternating decisions until many complaints are received before a senior case officer actually looks into it!

cvenn

I have just received 11 spam/phishing emails, all addressed to custom email addresses I created exclusively for Santander, Alliance & Leicester (my account was taken over by Santander) and Gourmet Burger Kitchen!