WARNING: Logged in to https://www.postcodelottery.co.uk and discovered a big data breach!

MouldyOldDough

No reports of this in the news !

flaneurs_lobster

MouldyOldDough said:

No reports of this in the news !

Nobody's lost any money.

Not significant enough for the major news providers to bother with.

No real local significance (despite the name) so the regional/local outlets don't have a "threat to local thing" angle to hang it on.

Apollonia22

I phoned their helpline yesterday and this morning , they're still 'assessing' the situation 

I've made my bank aware as a precaution 

Worrying 

Scoutuk

It seems very odd to me that MSE is the only place reporting this. As a journalist, I would certainly be filing copy about it. Where's their media relations department?

Neil_Jones

Scoutuk said:

It seems very odd to me that MSE is the only place reporting this. As a journalist, I would certainly be filing copy about it. Where's their media relations department?

MSE as in the main website aren't reporting it, as probably outside the remit of the site (aside from saving money by not entering lotteries in the first place)

A post on a web forum is usually not a reliable source for anything.

I doubt this is a "hack", its more likely somebody's tried to update some software behind the scenes and its broken something.

This sort of thing happens more often than you think, I can't remember where it was now but I logged into some other website somewhere a long while back and I had somebody else's details pop up.  The site wasn't anything high profile, think it was a web forum where the most damage I could have done was post as somebody else or read their Private Messages (and even then they aren't private private as the owner of the service could have probably seen them anyway).  Nobody was going to lose any money.

Its when the log-in details end up on the dark web in plain view you need to worry, even more so if you've re-used your password across multiple sites...

mrsbpt

This is very suspicious as today I have had emails telling me I have won an e-gift card.  The FROM email address is not in line with the normal email address so I have not clicked it yet.  Have tried to call them but been waiting over an hour so far so hung up 

Dizzy_Ditzy

mrsbpt said:

This is very suspicious as today I have had emails telling me I have won an e-gift card.  The FROM email address is not in line with the normal email address so I have not clicked it yet.  Have tried to call them but been waiting over an hour so far so hung up 

You can check any prizes by entering your postcode into their postcode checker https://www.postcodelottery.co.uk/winners/postcode-search

That should tell if if you’re to expect an email from them at least 

MyRealNameToo

Scoutuk said:

It seems very odd to me that MSE is the only place reporting this. As a journalist, I would certainly be filing copy about it. Where's their media relations department?

They're not reporting it. 

Whilst its clearly not good what's happened the reality is that some customers have seen some other random customers details which is a very different scale of issue than if a bad actor has gotten access and harvest the complete database of details. The vast majority of people getting some random strangers details are going to be confused and at most worried that their own details are going to be exposed rather than starting noting down the details and planning how you can defraud the person. 

Phishing is a numbers game, you email hundreds of thousands of people hoping to catch a few that fall for it. You'll need to be extremely luck to email a single person and manage to defraud them. 

victor2

Maybe it was short lived issue and given that the only place discussing it seems to be here, they think they'll get away with not reporting it because hardly anyone knows... 

Dizzy_Ditzy

They have commented on their Facebook that they had some “technical issues” and that a very small number of people were affected. Those people have been sent an email and the site is back up and running. I can’t see that this wouldn’t be reported to the ICO as the threshold for this is actually quite low