Verizon Exposes the Wrong 1,200 Email Addresses

netbuzz writes "If you're going to market your expertise by inviting 1,200 IT professionals to a seminar about securing data and protecting personal information, it's probably a good idea to protect the personal information of those you invite. On Tuesday, Verizon forgot that advice and blasted each of the 1,200 email addresses to everyone on the list ... and they did it 17 times."

Comments

Blunder

[mfh]

Whenever email scripts have too many recipients, they do tend to refresh and try again, which can cause dupes. These addresses were likely supposed to be in the BCC field, or nonexistent (duh). So it was a mistake.

That's an embarassing blunder, to hold a seminar on keeping private info secure and then spamming who is attending the seminar. I wonder how much time they will spend on that blunder, explaining how it can happen to anyone, even the mighty Verizon, but this foolishness will not strengthen Verizon's sales pitch.

Spammers attend these conferences. Now spammers have known email addresses of everyone there.

This would only make a difference if spammers made money based on sending targeted email. They don't. They make money based on volume of addresses when a shady merchant pays them. So maybe they could make $25 on this list?

Apart from making one person in Verizon look stupid, this also enforces the theory that it only takes one idiot to... the whole internet.

Re:Blunder

[Spacepup]

Spammers attend these conferences. Now spammers have known email addresses of everyone there.

If it's just spammers attending, then they only got the email addresses of other spammers. The spammers can spam themselves all they want for all I care.

Re:Blunder

[Ethanol-fueled]

As your score(1, insightful @ 12:38pm pacific time) demonstrates, there are mod points available for short-winded wastes of time.

Re:Blunder

[omega_dk]

That would be insightful, if it were not so clearly wrong. Plenty of spammers target specific individuals; see http://searchcio.techtarget.com/news/article/0,289142,sid182_gci1259674,00.html for a specific example. Now, one could argue that targeting IT professionals would be an exercise in futility. Would you bet your livelihood on it? Would you bet access (possibly high-trust access, depending on how high up this IT professional is) to your company's network on it?

Because that's what's at stake. It's not a question of sending email selling \/|agra to these people. It's a question of a very specific, highly targeted spam operation with the express purpose of getting access to the networks of these specific individuals, in the hopes that they can provide the access the infiltrator would want to the company as a whole.

Now, I am not saying that this is a big deal; it's not like these emails wouldn't have been available from some other source than this email list. However, I will say that by completely dismissing an entire segment of spam email, that of targeted emails to specific individuals, you are unnecessarily lulling both yourself and anyone who reads your comment into a false sense of security. Highly targeted spam is a real risk; don't discount it as a very real attack vector. You must be ever vigilant, and I don't think you can be with that kind of attitude.

Re:Blunder

[Obfuscant]

Now, one could argue that targeting IT professionals would be an exercise in futility.

Similarly, you'd think that spamming "postmaster" or "abuse" at a domain would be futile and wasteful, but I get more spam there than at my actual address.

Re:Blunder

[Anonymous Coward]

you showed him dude, I certainly wouldn't want to be him because I would be reeling from that burn

Re:Blunder

[AndrewNeo]

Probably because they assume it will be a valid address.

Re:Blunder

[Anonymous Coward]

enforces the theory that it only takes one idiot to... the whole internet.

You accidentally... the internet? The whole thing?!

Title is Misleading

[rehtonAesoohC]

It's not that Verizon exposed "the wrong" 1200 emails, it's that Verizon exposed any email addresses at all.

/bad title?

Re:Title is Misleading

[Anonymous Coward]

Sometimes you can get away with doing something stupid because nobody notices.

This was not one of those times.

Re:Title is Misleading

[reymyster]

I believe the "wrong" referred to in the title meant to imply that it was particularly bad to expose these specific emails, like when people say "you just messed with the wrong guy"

Re:Title is Misleading

[Gewalt]

It's not that Verizon exposed "the wrong" 1200 emails, it's that Verizon exposed any email addresses at all.

If ever there was a worst-case-scenario set of 1200 email addresses, this list was it.

Re:Title is Misleading

[Naughty Bob]

If ever there was a worst-case-scenario set of 1200 email addresses, this list was it.

Yes and no. In terms of potential harm done, these people are much more equipped than your average person to be able to mitigate this fuck up.

On the other hand, if there was ever a subsection of people who you donn't want to piss off in this regard....

Re:Title is Misleading

[flyingsquid]

It's not that Verizon exposed "the wrong" 1200 emails, it's that Verizon exposed any email addresses at all.

While I agree that the email slip-up was pretty bad, I was more concerned about some of the other sensitive information that Verizon publicized. In addition to those 1200 emails, Verizon also emailed other sensitive information including:

1.the secret herbs and spices that go into KFC's chicken

2. the combination to the door of the Bat Cave

3.The location of Dick Cheney's 'undisclosed location'

4. The chemical composition of Kryptonite

5. The burial site of Jimmy Hoffa

6. the nuclear launch codes for U.S. Trident nuclear missile submarines

7. the full name, post office box address, and social security number of the The Good, the Bad, and the Ugly's Man with No Name

8. the address and repository information for that government warehouse that contains the Ark of the Covenant (it's on rack 12, shelf 7, box 336)

Re:Title is Misleading

[Teun]

No, no.

Verison is so sure about their new security policies that they wanted to show the experts that publishing their collective addresses is no longer a problem.

Verizon responds

[MarkGriz]

"We just wanted to make sure you could hear us now"

Simple fix: boycot & save time

[Alwin Henseler]

If I were one of those invited, then a thing like this would immediately make me loose interest in whatever they'd have to say. Show in advance you can't do yourself what you're preaching about. Duh!

I'd just decline the invitation, and spend my time elsewhere (probably more productive). If a majority of the invited folks would do this, the event would be dead in the water. Killed by stupidity of the organization.

Re:Simple fix: boycot & save time

[mrchaotica]

...a thing like this would immediately make me loose interest...

Why, was your interest tight before?

Re:I know this is /. and all...

[david_thornley]

Except that there is absolutely nothing to distinguish some clerical errors and actual security issues. If information is leaked by clerical error, it's leaked just as effectively as if it were hacked out of an on-line database through cross-site scripting. Maybe more effectively.