Slashdot Mirror
Hackers Steal Kroger's Customer List
wiredmikey writes "Kroger, the nation's largest traditional grocery retailer with more than 338,000 associates, notified customers today of a breach of the database that stores its customers' names and email addresses. The company said the incident occurred at Epsilon, the third-party vendor Kroger uses to manage its customer email database." Reader SatanClauz
SatanClauz quotes the email that went out to Kroger customers ("We were notified and became aware of unauthorized access to our email list by someone outside our company. We want to assure you that the only information that was obtained were names and email addresses."), writing "At least they were smart enough to separate the email db from the rest of customer information! — or so they say..."
I wonder if this is something you can sue over. For example, is reusing the same password (as in the case of HBGary) considered negligent?
So, they got information that sites like Facebook make completely public anyway? I'm sorry, I guess I'm just all out of unwarranted outrage and fear today. Wake me up when they have credit card numbers, SSNs, or something like my mother's maiden name. You know, stuff that can actually be used for something malicious. All they can do now is send me an email with *gasp* my name in it!
today is spelling optional day.
I just got an email from US Bank this morning as well about the data breach with Epsilon. I wonder how many more companies are affected by this one third-party company.
Give a man a fire and he'll be warm for a day. But light a man on fire and he'll be warm for the rest of his life.
Why would anyone give their email address to a grocery retailer?
I just had a conversation with guy at a gas station as to why I didn't have one of their rewards cards. He kept assuring me that I wouldn't be tracked and yet I just don't believe that. For the record, assuming this list is for their "Plus Cards", we are likely on that list buuut only under a bogus name...or maybe I found a card that someone lost. Regardless, if it didn't save me $40 every time I went to the store, I wouldn't have it; saving $3 at a gas station every 3 weeks isn't enough of a reward to even bother filling out their "application". We call that "Jumping over dollars to pick up dimes"
0x09F911029D74E35BD84156C5635688C0
I got the e-mail from Kroger within three hours of receiving a very similar e-mail from Brookstone. Although not identical, the two e-mails are quite similar. Foes anyone know who this e-mail service provider is and what other companies may have been affected by this? It is nice to see Kroger and Brookstone act quickly to let their customers know the extent of the data that was compromised, but if this is the fault of a common e-mail service provider I would think that many more than just two companies were affected by this, and interesting to see how different companies react to the same issue. It is also good to see that the third party e-mailer is given only the base details necessary for them to perform their function and are not provided with street addresses or other unnecessary personally identifiable information.
++++++++++++Important E-Mail Security Alert++++++++++++
Dear Valued Brookstone Customer,
On March 31, we were informed by our e-mail service provider that your e-mail address may have been exposed by unauthorized entry into their system. Our e-mail service provider deploys e-mails on our behalf to customers in our e-mail database.
We want to assure you that the only information that may have been obtained was your first name and e-mail address. Your account and any other personally identifiable information are not stored in this system and were not at risk.
Please note, it is possible you may receive spam e-mail messages as a result. We want to urge you to be cautious when opening links or attachments from unknown third parties.
In keeping with best industry security practices, Brookstone will never ask you to provide or confirm any information, including credit card numbers, unless you are on our secure e-commerce site, Brookstone.com.
Our service provider has reported this incident to the appropriate authorities.
We regret this has taken place and for any inconvenience this may have caused you. We take your privacy very seriously, and we will continue to work diligently to protect your personal information.
Sincerely,
Brookstone Customer Care
Why am I not surprised?
I don't show up at Kroger (there aren't any close to where I live), but if I did, they would be hearing from me.
And exactly what would you do? Would you rip some 20 year old who is running the office, who has nothing to do with any of this? Would you see the store manager and rip him a new one, when HE has nothing at all to do with what the headquarters does?
You'd be dismayed at how often people actually believe that the guy behind the counter or on the end of a tech support line is the best target for a discussion about corporate policies and general unhappiness with capitalism and assorted laws of physics. The latter came up more than once in tech support. I declined to alter the universe at a fundamental level.
-- Using the preview button since 2005
So Kroger's customer list is stolen from Epsilon! I wonder what other companies are using Epsilon to manage their customer list. So we need to identify who is managing the client list of Epsilon. If that site is known to be hackable .. hee... hee... :-)
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Fortunately, my Kroger Plus card application was littered with fake information!
"... notified customers today of a breach of the database that stores its customers' fake names and fake email addresses."
There, fixed it for you.
No sig for you. YOU GET NO SIG!
So the Jewish conspiracy of reptile overlords in charge of Kroger can send out adverts that will in turn give them enough revenue to fund their NWO?
-- Using the preview button since 2005
If I were to take a stab in the dark answer to this question it would be for two purposes, the first would be to send you notices and perhaps coupons. The second would be for cross referencing with external data sources. I would guess that the vast majority of email users in the wild use the same email address for everything and having that data to cross reference your Kroger shopping profile with your Border's Books shopping profile could lead to some interesting data junctions. User is buying more fat free foods over the past 6 months and they have also started buying healthy cooking books. This could lead to some nicely targeted advertisements for weight loss or exercise programs.
I wouldn't be the least bit surprised to find that marketing companies are behind the break-ins.
Do what thou wilt shall be the whole of the Law - Aleister Crowley
I received a similar notification from US Bank today with regards to my linuxfund.org credit card. They called out Epsilon as the source of the leak, and claim no financial data was compromised.
---
As a valued U.S. Bank customer, we want to make you aware of a situation that has occurred related to your email address.
We have been informed by Epsilon Interactive, a vendor based in Dallas, Texas, that files containing your email address were accessed by unauthorized entry into their computer system. Epsilon helps us send you emails about products and services that may be of interest to you.
We want to assure you that U.S. Bank has never provided Epsilon with financial information about you. For your security, however, we wanted to call this matter to your attention. We ask that you remain alert to any unusual or suspicious emails.
---
Scratched Emulsion
Kroger has no idea who accessed their email system, let alone whether or not they were hackers. Seems more likely spammers, or perhaps fraudsters, would be interested in gaining accesses to customer names and email addresses.
In fact the word hacker appears nowhere in the article or summary. What is your major malfunction, Timothy?
I don't care why you're posting AC
I refuse to play the "discount card" game. When I make a purchase at the local CVS, they ask if I have a discount card. I say "no" and the clerk scans the store copy and I get the discount anyways without giving personal information. Often when going to stores that do not have a "store card", another customer offers their card and the clerk scans that without objection. I have even encountered clerks that have their personal card that they scan. These "discount cards" are a farce!
That's why I ask sharply if the info is actually required, and when they first try to hedge that it is, I begin cancelling my entire sale at which point they grudgingly admit "well, uh, really it's not, my manager just told me to ask".
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
I dunno - I trust "Joe in IT" more than that. However, the pointy heads are good at rolling stuff under rugs, so even if it was detected it would be instantly classified.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
Actually, I would contact their corporate offices and asked to be removed from their database entirely and to have my account with them deleted completely. I didn't mean that I would be seeking retribution, only to make sure that my information isn't further compromised in the future.
Social Engineering Expert: Because there is no patch for stupidity.
The punishment for the leak should be that Kroger has to abandon any attempts to collect or store information about their customers.
They're a grocery store. They don't need that info.
So they can notify you when your email address gets stolen, of course! Didn't think that one through, didja?
SIGSEGV caught, terminating
wait... not that kind of sig.
"third-party vendor Kroger uses to manage its customer "... why the hell are they using a third-party anything to manage THEIR customer data?
Oh, oh, I know! Because they don't care about their customers data, and want the option to sue + put the blame on someone if something goes wrong.
The only reason to use them is for gas points or other such rewards. I occasionally forget my discount card and use the store card, but at any major grocery store that gives gas points, I've found it worth it to have a card.
Social Engineering Expert: Because there is no patch for stupidity.
Spamming Brent Spiner, Johnny Bravo and Linus Torvalds!
There is no actual verification on those little forms. Though I did get a strange look for the Johnny Bravo one I submitted.
One of my friends even made one with the name Edgar Poe and he used this card specifically to purchase beer.
"You should always go to other people's funerals; otherwise, they won't come to yours." -- Yogi Berra
I wonder if this is something you can sue over.
Yes, some lawyer will gin up a "class action" suite to address the irreparable harm that mom, dad, gramps, and Cletus have suffered as a result of the disclosure of their almost certainly widely available email addy - and the fact that grandpa regularly buys extra large lubricated Trojans. And as is standard practice, the lawyer will walk away with 10 or 15 million while the harmed parties will get a 50 cent off anything coupon.
Yes, let's SUE! SUE! SUE! to address this heinous disregard for personal privacy of your disposable Hotmail account!
Kruger is "The Man", FUCK The Man! Stick it to The Man! SUE! SUE! SUE!
If you want news from today, you have to come back tomorrow.
The punishment for the leak should be that Kroger has to abandon any attempts to collect or store information about their customers.
They're a grocery store. They don't need that info.
Why should they be forced to do that? It's not Kroger's fault in the first place, it's Epsilon who made the mistake.
I didn't get the notification at my email address: nancydrew@example.com. Does that mean my data wasn't stolen?
I always set up a separate email account for every vendor I deal with. A surprising number of those email addresses end up getting into the hands of spammer/scammers. I always notify the companies that someone has compromised their email database, but only once have I received a response. It's no big deal for me to just divert all future email to that account to dev/null, but are there US federal laws that cover this, and is there any federal agency that should be notified so that these companies take security more seriously?
My entire life experience with that place is a fucking headache
Cant find a parking spot cause some "designer" made the place all artsy and then sucked up 2/3s of it with a dumb ass gas station
Oh its 12 outside and dumping sleet, cant fucking walk on the sidewalk cause they fortified it with shit you will never ever buy, watch out for traffic
Jumping over the mountain of fortified crap, soaked in ice nearly ran over by cars you go in to the wonderful smell of garbage and nasty looking carts, picking one that is the least covered in green sticky shit (its called a hose, use it once in a while)
walk in to find out you cant go anywhere cause there is so much shit by the in the isles you have exactly 18 inches from a display and either another display or a fucking post and if one person stops your stuck
garbage bags in the middle of baking supplies, pet foot touching roach poison, shit meat selection, play their stupid card game, understaffed registers (and god help you if you ask for a pack of smokes) I would rather staple my tongue than step foot in one
I'm a Kroger customer as it's right down the street. But I have received nothing from Kroger. No warning, no nothing. I am not a a happy camper.
I'm old, not dead. Well that's my 2 cents worth, your mileage may vary. I say what I think, not what you want to hear.
It would be nice is these discount card at Krogers actually gave you a discount. All it is, is the normal price at other stores that don't have this discount card scam running. You'd think if they are selling info and making money on it, then they could actually give a decent price on items, but as far as Krogers goes, they are WAY over priced on many, many items. At least the ones in my area are.
Because a grocery store needs to hold on to customer information! How else can they... uh... well, er... PROFIT?
So what do I need to do to convince a corporation to get rid of all customer data they have on me? Oh... wait... nevermind.
"I am an Adept of Tantric VAX."
Until you pull up to the gas pump and get $.30 off for 12 gallons. Your tin hat is costing you money.
If I used a sig over again, would anyone notice?
Notifications from US Bank and JPM have also gone out.
http://www.boiseweekly.com/CityDesk/archives/2011/04/02/chase-us-bank-customers-warned-of-e-mail-security-breach
If I wore your tin hat, it would cost me $1,000 a year in discounts from Kroger. But I don't wear the hat, I take the cash.
If I used a sig over again, would anyone notice?
I received an email just a few minutes ago from TiVo saying the same thing as the Kroger one, so does TiVo outsource their customer data to this company too?
If you do not wish to support the "discount card game", then vote with your
feet. Shop at stores that do not have the cards. If enough people do this,
you will see these "penalty cards" disappear.
And where would that be?
No grocery store in my area doesn't have these cards.
Apparently TiVo also used the same service, because I just got an email from them about names and email addresses being exposed.
U.S. Bank has the loan for my truck. I have no other dealings with them. Just got an email about the Epsilon information being stolen, supposedly only our email address (my wife's, actually). They apparently contract with Epsilon for their email services. This outsourcing of customer management always bothers me. It seems you are never dealing with a single company anymore; any commerce involves spreading your information out to a collective of "responsible" parties, regardless of appearances otherwise. Then, when problems arise, they have a 3rd party to point fingers at. If this had not happened, I probably never would have heard of "Epsilon".
>Why people give information to retailers is beyond me.
They don't care. They really, really don't care. It doesn't occur to them that there is any problem.
-fb Everything not expressly forbidden is now mandatory.
I really wonder why these guys keep database if they really can not protect it, there must be some policy to put a hefty fine on such organisations who do such gross negligence.
You do realize those aren't discounts, right?
They've just marked up the price for everybody without the card.
My wife got an email from TiVo, and I got an email from some branch of Disney vacation sales (no surprise -- we took a trip to DisneyWorld like 5 years ago and they still have my email address).
This is affecting a lot of companies.
Huh, you know, I did the same thing with CVS but I haven't actually used the card. I wonder if it works...
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
You might be surprised about Kroger - they have 17+ banners they do business with. There might not be a Kroger store, but there might be a Fry's, Smith's, Ralph's, Fred Meyer, QFC, or King Soopers.
They are all Kroger.
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.