Cisco Says Vegas Conference Attendees' Information Was Leaked

Julie188 writes "Thousands of people got a nasty e-mail this morning from Cisco. The company was warning people that its attendee registration database for its Cisco Live 2010 event was hacked. Cisco Live 2010 is the company's annual user conference, held last week in Las Vegas with an estimated 18,000 in attendance. If it's not embarrassing enough for a company that sells security gear to get hacked, the e-mail also went out to people who didn't register and didn't attend the event. That raises questions about exactly what database was pried open and how bad the damage is. Cisco's e-mail said the hole was quickly closed and only business-card type information was exposed."

Comments

Routing error

[girlintraining]

the e-mail also went out to people who didn't register and didn't attend the event.

That's even more embarassing than a security breach -- it's a routing error. From Cisco.

Re:Routing error

[skids]

Cisco's customers will not find bureaucratic bungling from them to be anything out of the ordinary, trust me, they are very used to it.

TFA

[Anonymous Coward]

We hope you have returned home safely and are back into your normal routine after a busy week at Cisco Live 2010.

We are contacting you because on the final afternoon of Cisco Live, one of our vendors identified an unexpected attempt to access attendee information through ciscolive2010.com. The ability to access this information was quickly removed, but not before some conference listings were accessed.

Cisco Live takes the security of attendee information very seriously and immediately elevated this matter to our chief security officer. His team completed a thorough review and as a result we believe your registration information – specifically your Cisco Live badge number, name, title, company address and email address– was accessed. No other information was available or accessed.

Although these details are commonly accessed by our World of Solutions partners and often freely provided by Cisco Live attendees, we felt it was our responsibility to inform you as quickly as possible. As we cannot yet confirm the information was accessed by an authorized Cisco Live partner, we encourage you to consider the appropriate precautions to protect against any unwanted email.

Please accept our apologies for any inconvenience that may result and feel free to contact us directly at support@ciscolive2010.com if you have any additional questions or information.

We hope you enjoyed your Cisco Live experience and we look forward to welcoming you to Las Vegas in 2011.
Regards,

so what?

[Lord Ender]

I can't think of anything less important than seeing phonebook-style data made public. Losing credit card numbers or bank account numbers for large groups is bad; losing email addresses is not.

Re:so what?

[foo1752]

Losing credit card numbers or bank account numbers for large groups is bad; losing email addresses is not.

Losing email addresses is not AS BAD as losing more sensitive information, but it is still not good. I, for one, wouldn't be happy about that information being exposed.

Re:so what?

[eln]

I agree. I can't even imagine what would happen if anyone found out I had attended a Cisco conference. I would be a social pariah. My children wouldn't be able to look me in the eye. My wife would leave me. The dog would run away. Even my cats would look at me even more disdainfully than they usually do.

It could be worse...

[Extremus]

They could stay quiet about it.

Is the email from Cisco legit?

[mulgar]

Can someone paste the header to see if the email from "Cisco" is legit or fraudulent? I attended Cisco Live and received no such email, and people who didn't attend received the mail, the Cisco Live team has a database of everyone who registered for the event so if the email was legit I would have expected to see it get sent to the correct audience?

Re:Is the email from Cisco legit?

[mulgar]

So I'm a Cisco employee who attended Cisco Live as a speaker last week, I just checked with a contact (who sends emails out from support@ciscolive.com) and they are not aware of any of this - which leads me to think the email is faked. If someone can provide the original email header so we can investigate further that would be appreciated... my contact is checking into this further I will update if I find out anything else...

Re:Is the email from Cisco legit?

[bugs2squash]

The TAC called, and unless you can set up a second Live 2010 conference and reproduce the problem they're going to close the ticket.

Re:Is the email from Cisco legit?

[mulgar]

Okay, as far as I can tell from my Cisco Live team contacts the email is legit and was sent from Cisco, but I don't have any further information on the leaked data as I'm not involved there so I won't speculate - there is a team investigating this and I'll leave it up to them to provide further details. The only details I can provide is pretty much already covered in the email sent out: “Cisco has been made aware that some Cisco Live registration information may have been accessible to an outside party through the conference website. Our first priority is the security of our attendees and we take their privacy very seriously. The ability to access this information was immediately removed and the matter was elevated to Cisco’s chief security officer for immediate review. Our review showed that affected information is strictly limited to the name, title, affiliation, and email address of some Cisco Live attendees. No additional personal information – such as credit card data -- was compromised. As the affected information is limited to data that is commonly available via badge swipes onsite and/or the exchange of business cards, we do not believe this presents any threat to our attendees in terms of identity theft. The impact will likely be limited to unsolicited email communication. We are currently reaching out to those individuals to keep them informed and offer our apologies for any inconvenience.” – Cisco spokesperson.

Re:Is the email from Cisco legit?

[blair1q]

I did not attend and I have not received any emails of this type.

In case you're being thorough about data, here.

They were going to let their "partners" spam you

[Animats]

Cisco collected that information so they and their "partners" could spam you: "... we believe your registration information - specifically your Cisco Live badge number, name, title, company address and email address- was accessed. No other information was available or accessed. Although these details are commonly accessed by our World of Solutions partners".... Their "partner locator" finds 16601 partners in the United States, 3241 in China, 998 in Russia, 427 in Romania. 330 in Nigeria, and 12 in Afghanistan. So just about anybody who wants that data could get it.

They're just irked that someone who didn't pay for their mailing list might spam you.

Re:They were going to let their "partners" spam yo

[Anonymous Psychopath]

Cisco's entire worldwide partner ecosystem != Cisco Live! World of Solutions, which was a vendor booth exhibition at Cisco Live in Las Vegas last week.

I'm not sure how many partners were in World of Solutions but there were perhaps 200. Companies like EMC, APC, CA, etc. You want a light-up rubber ball or blinking shot glass or whatever shiny object they were giving away at their booths, you let them scan your badge. Some had booth babes running around with scanners, which was fairly effective at a conference where 95% of the attendees are men.

Every conference I've ever attended has worked this way.