ISP Emails Customer Database To Thousands

Barence writes "British ISP Demon Internet has mistakenly sent out a spreadsheet containing the personal details of more than 3,600 customers with one of its new ebills. The spreadsheet contains email addresses, telephone numbers and what appears to be usernames and passwords for the ebilling system. It was attached to an email explaining how to use the new system. Police forces and NHS trusts are among the email addresses listed in the database. A spokesman for Demon Internet confirmed that the company "was aware this happened this morning"."

Comments

Free market will fix this

[cryfreedomlove]

Is there a good alternative ISP available to the same customers. If so, then I would expect a stampede away from Demon ISP to their competitor. There is no need for government intervention.

Re:Free market will fix this

[Anonymous Coward]

Storing user passwords unencrypted in an excel spreadsheet should be a crime.

Maybe it isn't. But I consider it to be a criminal level of negligence with significant public harm.

Re:Free market will fix this

[icebike]

Having a company be able to SEE any user's password should be a crime. Standard practice is that NOBODY, not even sysadmins can see it. They can change it but not see it.

Re:Free market will fix this

[dbIII]

If even the computer knows the password somebody has made a hash of the job :)
It's not 1980 anymore and we have the hardware and software to make secure password handling with hashes instead of recorded passwords a very simple process, so that's the first link in this long chain of failure. That those doing the billing have access to the passwords show that there are a lot of links in this chain that should not be there.

Re:Free market will fix this

[Anonymous Coward]

If even the computer knows the password somebody has made a hash of the job

Of course you mean that if even the computer knows the password, somebody failed to make a hash of it. Good call though!

One more reason...

[popo]

... that privacy 'policies' don't mean squat...

To err is human...

[Smidge207]

Human error is understandable, but the fact that Demon seems to have very little internal security seems very disappointing.

A spreadsheet with customers username and password should have been able to be distributed outside of the company system, I find it to be gross incompetence on the part of companies and organisations who have little or no internal document security system to prevent small breaches such as this.

Someone had better lose their job.

[olsmeister]

Hard to believe that anyone in that type of position working for an ISP could be so careless. If anyone should know better, they should.
I'd be curious to know if the passwords that were lost are ISP-assigned gibberish passwords, or user selected ones.
If they are passwords selected by the users, look out. Too many people use the same passwords for many or all of their accounts.

Re:Who is to blame?

[SlashDev]

or an overworked employee, who decided to take a nap, at their desk.

Cleartext Passwords? Really?

[algae]

The real WTF is that all those passwords were in the clear. What the hell business does anyone have these days, doing anything more than storing a one-way hash?

Notice the words carefully...

[freedom_india]

...when a corporate is involved it always is a MISTAKE.
When an individual hacker exposes weak security, he is a terrorist.
Wow!
Talk about double standards.
Why can't the corporate be sued on SAME grounds like hackers?

Re:Really!

[Kalriath]

Credit Card info? That's a violation of PCI DSS right there along the lines of the great Web Hosting Talk fuck-up of last year. You can be fined millions for that.

Re:My experience of the same thing...

[7 digits]

Snopes says it is true.

I also like the idea of Wells Fargo sending this to customers:

You owe your soul to the company store. Why not owe your home to Wells Fargo? An equity advantage loan can help you spend what would have been your children's inheritance.