Slashdot Mirror


Epsilon Breach Affects JPMorgan Chase, Capital One

Orome1 writes "The recent Play.com breach has been tied to the attack that its marketing communications firm Silverpop — a company that services over 105 customers, among whom are Walgreens and McDonalds — suffered last December. But the latest breach will likely have the biggest impact, because marketing services provider Epsilon — the largest one in the world — has notified its customers of a breach that likely compromised all of their mailing lists. Among Epsilon's customers are US Bank, JPMorgan Chase, TiVo, Capital One, the Home Shopping Network, LL Bean Visa Card, Ritz-Carlton Rewards, Best Buy, Disney Destinations, Walgreens, and many more." How many apology emails have you got so far today?

180 comments

  1. Received one this morning. by grub · · Score: 5, Interesting
    I received this today. Another case where I'm happy to use throw-away accounts at a domain I own.

    Dear [me],

    We have been informed by our email service provider, Epsilon, that your name
    and email address have been exposed by unauthorized entry into their system.
    Epsilon deploys emails on our behalf to our Reward Zone members. Click here
    to read Epsilon's statement.

    We have been assured by Epsilon that the only information that has been
    exposed was your name and email address. A rigorous assessment by Epsilon
    has determined that account details, passwords or any other personal
    information were not at risk.

    It is possible that you may receive spam email messages as a result and we
    would advise you to be very cautious when opening links or attachments from
    unknown senders. More information on spam and protecting yourself from email
    fraud can be found here.

    In keeping with security industry best practices, Best Buy will never ask
    you to provide or confirm any information, including credit card numbers,
    unless you are on our secure e-commerce site, www.bestbuy.ca. If you receive
    an email asking for personal information, delete it. It did not come from
    Best Buy. The next scheduled email from Reward Zone about our Trade In Event
    will arrive to your inbox on April 15, 2011.

    Our service provider has reported this incident to the appropriate
    authorities.

    We regret this has taken place and any inconvenience this may have caused
    you. We take your privacy very seriously, and we are working diligently to
    fully investigate this situation and continue to protect your personal
    information. If you have further concerns or questions please contact us:
    1-866-BEST-BUY (238-7289) or customercare@bestbuycanada.ca.

    Sincerely,

    Angela Scardillo
    Vice President of Marketing
    Best Buy Canada

    --
    Trolling is a art,
    1. Re:Received one this morning. by O(+inf) · · Score: 1

      Ditto - the only one seen so far was from Best Buy.

    2. Re:Received one this morning. by Anonymous Coward · · Score: 0

      One from robert half international

    3. Re:Received one this morning. by Anonymous Coward · · Score: 0

      The U.S. version had a commercial for BBY's Geek Squad.

    4. Re:Received one this morning. by gfreeman · · Score: 1

      Yup, I had one from TiVo.

      --
      Ceci n'est pas un sig.
    5. Re:Received one this morning. by ObsessiveMathsFreak · · Score: 1

      You don't perchance happen to have the email you sent them granting them permission to release your email address on to Epsilon and/or any other subcontractor/partnered company which fancy placed within their heads? I can only presume that ni private company would be do dishonourable as to throw your or anyone else's email address about like corporate confetti paper without your explicit written permission. Perish the thought!

      --
      May the Maths Be with you!
    6. Re:Received one this morning. by Anonymous Coward · · Score: 0

      +1 for RHI/RHT

    7. Re:Received one this morning. by grub · · Score: 1

      It's usually in the small print of the contracts you sign to get a card from the firms.

      --
      Trolling is a art,
    8. Re:Received one this morning. by omnichad · · Score: 1

      You never signed anything to allow them to hire employees to send you these messages either. They have to pay somebody to do it. Where's the legal requirement that you can't hire outside your own corporation without permission?

    9. Re:Received one this morning. by randizzle3000 · · Score: 1

      My wife received one of these from USBank on Apr 3. I have not received anything.

    10. Re:Received one this morning. by cdrudge · · Score: 2

      From Best Buy's Privacy Policy:

      Uses of Information
      - Best Buy does not sell, rent or trade your personal information to third parties.
      - We use information about you to fulfill your requests, administer various programs, provide services, and for other business purposes.
      - Your personal information may be shared with current or future Best Buy entities or subsidiaries. We may also use the information you provide to send you marketing communications.
      - In limited circumstances, Best Buy may need to share your information with certain third parties to perform services on our behalf.

      The last point applies specifically to the issue at hand, and they haven't broken their written policy.

    11. Re:Received one this morning. by FatdogHaiku · · Score: 1

      The U.S. version had a commercial for BBY's Geek Squad.

      Hey, that's an interesting marketing twist:
      "We can't take care of our own shit, so how about we mess with your stuff instead"
      P.S. Mention this email and we will give you a 50% discount... So you'll only be paying twice what other shops would charge you!

      --
      You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
    12. Re:Received one this morning. by dgatwood · · Score: 2

      Oddly enough, I didn't. Guess they've lost my contact info.

      --

      Check out my sci-fi/humor trilogy at PatriotsBooks.

    13. Re:Received one this morning. by jtull89 · · Score: 1

      Sadly I got one from Best Buy AND Chase. It's bad enough that these guys know that I shop at Best Buy, but to know where I have one of my bank accounts? That's just frickin' creepy!

    14. Re:Received one this morning. by divide+overflow · · Score: 1

      Another +1 from RHI

    15. Re:Received one this morning. by biggknifeparty · · Score: 1

      Look at your provincial / state governments privacy acts. There are instances where this type of violation of privacy rights are statutory torts (legislation). If you're lucky, your province / state may not even require you to prove damages to file an action for violation of privacy. If you don't have that type of protection, I'm sure that there's a waiver of liability from BestBuy in your contract.

    16. Re:Received one this morning. by Seumas · · Score: 1

      I haven't received a single one, even though I've done business with some of those companies that were affected.

    17. Re:Received one this morning. by Anonymous Coward · · Score: 0

      You gave your real email to Best Buy?

    18. Re:Received one this morning. by grub · · Score: 1

      Re-read my post: I give throwaway accounts everywhere to one of my domains. Spam starts, account closes.

      --
      Trolling is a art,
    19. Re:Received one this morning. by mrxak · · Score: 1

      Yeah, same here. I got one of these from Best Buy this morning. I smiled when I noticed the email had arrived in my catchall account, having been sent to a fake email address on my primary domain. I've been ignoring all the (legitimate) spam at that address for the entire time anyway, so it's no big deal.

    20. Re:Received one this morning. by bjohnso5 · · Score: 1

      I got this one from Best Buy and another from Air Miles. All in all, not so bad.

    21. Re:Received one this morning. by grub · · Score: 1

      Yeah I had an AirMiles one this morning as well.

      --
      Trolling is a art,
    22. Re:Received one this morning. by KhabaLox · · Score: 1

      I use my real Gmail address when I sign up for most things. If they are going to be sending me things I want (e.g. e-receipts or shipping confirmations from Best Buy, Amazon, etc.) then I'll do nothing. If they are only going to send me spam newsletters and sales offers, then I will set up a filter in Gmail.

      What I'd really like to be able to do though is have a filter which puts a time bomb on an email, so that it deletes it after 30 days. That way, I could save the sales offer by default in case I end up shopping there in the next 30 days. But then Gmail will auto delete it for me so I don't have to worry about keeping my account clean (not that you really have to do that with Gmail anyway).

      --
      Ceci n'est pas un sig.
  2. None by hedwards · · Score: 2

    I haven't gotten any yet, although I have done business with a few. If anything this is a reminder that services like Sneakemail exist for a reason.

    1. Re:None by Anonymous Coward · · Score: 0

      used to use sneakemail specifically for these types of email messages.. too bad they no longer have the limited free level of service.

    2. Re:None by Anonymous Coward · · Score: 0

      $2 a month? Just use spamgourmet instead for free.

  3. what good is an apology... by Lead+Butthead · · Score: 3, Insightful

    if the sender isn't sincere? the notifications are sent because they're required by law, not because they're truly sorry in any shape or form.

    --
    ELOI, ELOI, LAMA SABACHTHANI!?
    1. Re:what good is an apology... by gujo-odori · · Score: 1

      None whatsoever, of course, except to let you know to be more vigilant than usual because your PII got pwned on their watch.

      I work in anti-phishing. The weeks ahead should be interesting. Our bank was on the list of those pwned. Gotta warn my wife to be especially vigilant of phishing.

    2. Re:what good is an apology... by Ambiguous+Coward · · Score: 3, Informative

      Oh, come on now, let's be fair, they're all really quite sorry...

      ...sorry the public was made aware of the breach.

      --
      Their may be a grammatical error, misspeling, or evn a typo in this post.
    3. Re:what good is an apology... by Anonymous Coward · · Score: 1

      If you ever expect a corporation to "be sorry" or truely remorse then that's the problem. They cant, they are NOT people.

    4. Re:what good is an apology... by Anonymous Coward · · Score: 1, Informative

      the supreme court disagrees

    5. Re:what good is an apology... by MollyB · · Score: 0

      Gotta warn my wife

      How very condescending of you. I just bet she'll be thrilled to hear you have an excuse to harangue her. Leave your job at work...

    6. Re:what good is an apology... by mitler · · Score: 2

      You're right. It's probably better that he not take the time to warn her that their email address may have been compromised, even though she may not work in the IT industry and not follow this type of news. At least she will feel like a strong independent woman as she clicks on that fake PayPal account verification link.

    7. Re:what good is an apology... by Thud457 · · Score: 1

      they don't have souls,
      hence are creatures of the devil
      QED

      --

      the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff

    8. Re:what good is an apology... by Anonymous Coward · · Score: 0

      No sense of humor, today? Good to know that Paternal Righteous Indignation is still swimming in the gene pool.
      (hint: if he does this for a living, she's already aware of the peril from malmail)

    9. Re:what good is an apology... by Anonymous Coward · · Score: 0

      The US Supreme Court disagrees again.

    10. Re:what good is an apology... by Anonymous Coward · · Score: 0

      Yeah, I was really pissed off when I got a notice, not just from Best Buy, but from friggin' Chase bank.

    11. Re:what good is an apology... by gujo-odori · · Score: 1

      Uhh, who exactly is being condescending here? My wife neither knows nor wants to know anything about computers or security. That's my job. Heck, it's one of the reasons she went out with me in the first place. Dating a sysadmin meant she didn't have to worry about that crap anymore. Keeping her computer secure and working is my responsibility, including letting her no what to watch out for. If you're really an old sysop, as you claim, you know perfectly well that people are the weakest link and need to be warned. Most especially if they are clueless about security.

      She's a brilliant and accomplished entrepreneur who made her family rich is probably a fuck of a lot smarter and better looking than you (and did I mention less condescending?). But computers? No, that ain't her thing. She said "Thanks for the heads-up."

      Condescendingly yours.

    12. Re:what good is an apology... by Anonymous Coward · · Score: 0

      I apologize for my rash posting. It was a lame joke that went south. Don't know what got into me... Since you've seen my journal and posting history, you should know this was out-of-character, and I regret having annoyed you. Peace.

  4. Not a lot... by rwven · · Score: 1

    So far, best buy and robert half technology.

    1. Re:Not a lot... by Anonymous Coward · · Score: 2, Funny

      we are spam twins!

    2. Re:Not a lot... by Svartalf · · Score: 1

      Ahhh... But the banks will putz and futz around before disclosing that they pooched this. (And they did...they outsourced this to a third party which doesn't have the same IT security requirements THEY have...) It's bad for business for to own up to this sort of thing- and they'll put it off until the last possible moment.

      --
      I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
    3. Re:Not a lot... by nschubach · · Score: 1

      Not sure if it was "putz and futz" but I got my alert from Chase before anyone else.

      --
      Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
    4. Re:Not a lot... by mldi · · Score: 1

      I got one from US Bank, so there goes that.

      --
      If you aren't suspicious of your government's actions, you aren't doing your job as a responsible citizen.
    5. Re:Not a lot... by Anonymous Coward · · Score: 0

      I got my JP Morgan Chase apology today. Try again.

  5. How does this happen? by jaymz666 · · Score: 2

    I have received these from Best Buy and TiVo so far.

    Seriously, why do all these companies outsource to such a crappy company that in one breach ALL their email lists get compromised? Does it really save them money to not operate the mailing lists themselves?

    1. Re:How does this happen? by jaymz666 · · Score: 1, Informative

      TiVo® Service Announcement

      Dear TiVo Customer,

      Today we were informed by our email service provider that your email address was exposed due to unauthorized access of their system. Our email service provider deploys emails on our behalf to customers who have opted into email-based communications from us.

      We were advised by our email service provider that the information that was obtained was limited to first name and/or email addresses only. Your service and any other personally identifiable information were not at risk and remain secure.

      Please note, it is possible you may receive spam email messages as a result. We want to urge you to be cautious when opening links or attachments from unknown third parties.

      We regret this has taken place and apologize for any inconvenience this may have caused you. We take your privacy very seriously, and we will continue to work diligently to protect your personal information.

      If you have unsubscribed in the past, there is no need to unsubscribe again. Your preferences will remain in place.

      Sincerely,
      The TiVo Team

    2. Re:How does this happen? by hedwards · · Score: 4, Interesting

      It's not so much a matter of money as it is one of logistics. Maintaining an farm of mail servers for what is a relatively low volume of correspondence doesn't make much sense. You still have to keep them secured, track opt outs and all the other stuff, handing it over to a 3rd party generally makes more sense. Plus, there's no guarantee that they'll manage any better.

      If anything this is just evidence that Epsilon screwed up and wasn't adequately separating the data. Without more information it's hard to say what they did, but chances are they were storing the various mailing lists on the same database servers.

      Capitalone, spends a lot of money protecting its customers from fraud, I know that because they're regularly on the phone with me when their computers pick up suspicious activities, and typically the account is locked within a minute pending authorization from me. I have a hard time believing that they'd spend all that money on security in that area and then go with a cut cost fly by night vendor for managing their emails. It's possible, but strikes me as odd.

    3. Re:How does this happen? by compro01 · · Score: 2

      Epsilon's service includes dodging anti-spam measures, which would be difficult to do if it's not your primary business.

      --
      upon the advice of my lawyer, i have no sig at this time
    4. Re:How does this happen? by jaymz666 · · Score: 1

      I guess sending less spammy messages would be too difficult a choice to make

    5. Re:How does this happen? by omnichad · · Score: 3, Interesting

      I wish it were that easy these days. You try maintaining an email server to send out marketing messages when you don't have SPF, Domainkeys, or SenderScore certification. Even sending out undeliverable email notices will get you put on an IP block list before you knew what happened. I could go on, but none of these things involve spammy keywords being in the message at all.

    6. Re:How does this happen? by omnichad · · Score: 1

      Even sending out undeliverable email notices

      I meant to say "even if your server is configured to send out undeliverable email notices when emails are received for invalid addresses."

    7. Re:How does this happen? by compro01 · · Score: 2

      It's not the message content, but rather the traffic patterns. Lots of email providers use dumb systems like "if a particular mailserver sends me more than X messages at once, increase their spam probability by Y" and similar. Epsilon has that data, either from the ISPs or from their own testing and uses that to get around those measures.

      --
      upon the advice of my lawyer, i have no sig at this time
    8. Re:How does this happen? by Anonymous Coward · · Score: 0

      Yes, their service works around anti-spam very well for the normal messages I get from TiVo. However, if not for the notification I saw on Slashdot the other day about this I would never have known TiVo (epsilon) tried to send me information about this breach. It went into the server-side junk filter on comcast (which I never check because there is never anything in it). I imagine they were "hoping" a lot of these notes would get into the spam bucket whereas their normal notes they really want to make sure they get past filters.

    9. Re:How does this happen? by himself · · Score: 1

      It was written, "Maintaining an farm of mail servers for what is a relatively low volume of correspondence doesn't make much sense. "

      Allow me to offer a new alternative: search your corporate soul and decide whether the email you're sending is really that important.

      I got one of these notices from my CC company, and it made me really mad when I thought about how I have *never* received an email from them that wasn't an attempt to sell a balance transfer or other undesired service. Ugh.

    10. Re:How does this happen? by Rich0 · · Score: 1

      Simple - there is no reason not to.

      What are you going to do - not do business with any of the 100 companies that were compromised? All of their competitors were compromised as well.

      It is like complaining about SMS prices on US cell carriers - as long as everybody offers lousy service and the FTC refuses to regulate, customers get to choose between various levels of crappiness...

    11. Re:How does this happen? by Culture20 · · Score: 2

      I got one of these notices from my CC company, and it made me really mad when I thought about how I have *never* received an email from them that wasn't an attempt to sell a balance transfer or other undesired service.

      You have now.

    12. Re:How does this happen? by himself · · Score: 1

      OK, that hurt.

    13. Re:How does this happen? by Anonymous Coward · · Score: 0

      I don't know how the figure can be trusted, but they're stating it was only 2% of the list. I also don't know if 2% is 2000 or 20,000,000.
      http://venturebeat.com/2011/04/04/how-many-times-did-epsilon-lose-your-personal-email-data/

  6. US Bank by jmanforever · · Score: 2

    As a valued U.S. Bank customer, we want to make you aware of a situation that has occurred related to your email address.

    We have been informed by Epsilon Interactive, a vendor based in Dallas, Texas, that files containing your email address were accessed by unauthorized entry into their computer system. Epsilon helps us send you emails about products and services that may be of interest to you.

    We want to assure you that U.S. Bank has never provided Epsilon with financial information about you. For your security, however, we wanted to call this matter to your attention. We ask that you remain alert to any unusual or suspicious emails.

    Please remember that U.S. Bank will never request information such as your personal ID, password, social security number, PIN or account number via email. For your safety, never share this or similar information in response to an email request at any time. To learn more about recognizing online fraud issues, visit:
    http://www.usbank.com/cgi_w/cfm/about/online_security/online_fraud.cfm

    In addition, if you receive any suspicious looking emails, please tell us immediately.
    Call U.S. Bank Customer Service at 800-US-BANKS (800-872-2657).

    The security of your information is important to us, and we apologize for any inconvenience this may have caused you. As always, if you have any questions, or need any additional information, please do not hesitate to contact us.

    1. Re:US Bank by HTH+NE1 · · Score: 0

      Dear valued U.S. Bank customer,

      Thank you for publicly confirming that you are a customer of U.S. Bank. Your Slashdot ID and pseudonym will now be added to our data mine for association to the other information we have on file, as well as your past posting history to better profile you and your interests.

      Epsilon

      Really, people? Do you know what you're doing when you post these? You're leaking more information about yourself and exposing another on-line identity to being known and associated by Big Data. Are you certain the precise phrasing of the letter you received is not unique to you, or even came from the institution it proclaims to be?

      --
      Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
    2. Re:US Bank by Svartalf · · Score: 1

      Now that's how a Bank should be handling this fiasco on the customer facing side. One wonders if they'll audit their suppliers a little better and more often.

      --
      I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
    3. Re:US Bank by Cl1mh4224rd · · Score: 1

      I got the same email. Ironically, Thunderbird flagged it as a potential scam. Heh.

      --
      People will pass up steak once a week, for crap every day.
    4. Re:US Bank by smelch · · Score: 0

      Your post is the most retarded post I've ever read.

      --
      If I can just reach out with my words and touch a butthole, just one, it will all be worth it.
    5. Re:US Bank by Cl1mh4224rd · · Score: 1

      Are you certain the precise phrasing of the letter you received is not unique to you, or even came from the institution it proclaims to be?

      There is such a thing as unhealthy paranoia, sir. As another of US Bank's customers, I can confirm that the phrasing is identical. But who knows? Maybe there's some secret brainwave scanner encoded into the text which transmits the thoughts of anyone reading it back to US Bank's headquarters located in the heart of an active volcano.

      --
      People will pass up steak once a week, for crap every day.
    6. Re:US Bank by Anonymous Coward · · Score: 0

      Not if the email's any indication. Including a link to a banks domain in an email from the bank? You're not supposed to do that - and now that they've done it the scammers will have a higher success rate as people will think it's normal for the bank to do that.

    7. Re:US Bank by Anonymous Coward · · Score: 0

      I'm wondering now if scammers will start using all these messages to piggy-back off of and send more scam emails.

      Dear valued U.S. Bank customer,

      Please click this link to confirm you are who you are.

      U.S. Bank

    8. Re:US Bank by Anonymous Coward · · Score: 0

      Remember kids:

      • Big Business, Big Oil, Big Pharma = Bad
      • Big Government, Big Labor, Big Data = Good
    9. Re:US Bank by tyrione · · Score: 1

      It's not unique. That is US Bank's direct form response.

  7. just Best Buy so far, I thought it was phishing by TrogL · · Score: 1

    Called the company to report a phishing attempt and they said no, it was legit.

  8. List of victim companies by Machtyn · · Score: 1

    I received two this morning. Best Buy and Robert Half. I'm sure there will be more coming. And I wonder what the impact will be. Really, the spam blocker hardware and software technology really do a decent job of reducing the trash.

    1. Re:List of victim companies by Rob+the+Bold · · Score: 1

      I received two this morning. Best Buy and Robert Half. I'm sure there will be more coming. And I wonder what the impact will be. Really, the spam blocker hardware and software technology really do a decent job of reducing the trash.

      That's an interesting point. It's not like spammers have a lack of email addresses. Most spam to mine -- like yours -- is blocked by spam blockers at the POP level, not because my primary email address isn't already out there.

      So were "they" after something more than just a collection of addresses they could have obtained in less dramatic ways? I have to suppose that more than just addresses were lost, because otherwise, what's the point?

      At first I thought maybe they wanted more up-to-date and valid information. But would this collection be necessarily of any higher quality? Surely plenty of these addresses are no good anymore just do to address churn switching ISPs. Right?

      --
      I am not a crackpot.
    2. Re:List of victim companies by DarkOx · · Score: 2

      They got more then just Names and E-mail address.
      The address they got probably have a much higher validity rate than other sources.
      They know which list you were on and can probably do some joins to get figure out if you were on multiple lists.

      That makes for some big wins for phising. If I am phishing I and I send you a mail about your Visa card chances are you have one and with a lots of luck you just might fall for it. If I send you a mail about your LL Bean Visa card well not nearly so many people have those and you are probably at least a little more likely to bite fall for it as its very specific and I can customize the thing with your name spelled just as you have it on the account.

         

      --
      Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
    3. Re:List of victim companies by jank1887 · · Score: 2

      If nothing else, they now probably have a list of known live (mostly) email addresses tied to a valid company. I get tons of 'you have twitter notifications' spam, even though I don't use Twitter. Easy to ignore. But if I started getting phishing spam acting like my credit union, using my properly spelled name and email, it would be a different story. And, this includes grandma and her bank account, too. Go ahead, tell grandma to check the message source before she clicks a link to her bank that she actually remembers signing up for. See how far that gets ya.

    4. Re:List of victim companies by Anonymous Coward · · Score: 0

      That's an interesting point. It's not like spammers have a lack of email addresses. ... So were "they" after something more than just a collection of addresses they could have obtained in less dramatic ways? I have to suppose that more than just addresses were lost, because otherwise, what's the point?

      Yes, they have your name, and they know who you are a customer of.

      These two additions will allow them to phish more effectively.

  9. Best Buy and Ameriprise, so far. by ptbarnett · · Score: 1

    I'm expecting one from Walgreen's and Marriott soon.

  10. Got one yesterday by WreckDiver · · Score: 1

    Epsilon Informs AbeBooks of E-mail Database Breach

    We have been informed by Epsilon, a third-party vendor we use to send e-mails, that an unauthorized person outside their company accessed files that included e-mail addresses of some AbeBooks customers. Epsilon has advised us that the files that were accessed did not include any customer information other than email addresses.

    As a reminder, AbeBooks will never ask customers for personal or account information in an e-mail. Please exercise caution if you get any emails that ask for personal information or direct you to a site where you are asked to provide personal information.

  11. Wonderful. by bobdotorg · · Score: 4, Interesting

    I cancelled my Chase accounts a month ago when they instituted a $120 a year fee on their 'Free Lifetime Checking' accounts.

    And yet they retained and leaked my email address.

    Can I charge them a $10 monthly fee for spam removal?

    --
    __ Someday, but not this morning, I'll finally learn to use the preview button.
    1. Re:Wonderful. by kitsunewarlock · · Score: 1

      Did they sign a contract you made to that or another effect along the lines of "if I ever want to charge you, I will." (Of course they send prior notice...albeit usually in 5 point font in what feels like a spam mailing to encourage it being dumped and forgotten about.)

      --
      Ginga no Rekshiya Mata Each page.
    2. Re:Wonderful. by v1 · · Score: 1

      yes chase seems to be in the business of driving away their customers nowadays. I took off when they decided to jack my interest rate from 9.9 to 18% for literally no reason.

      --
      I work for the Department of Redundancy Department.
    3. Re:Wonderful. by Jeremiah+Cornelius · · Score: 1

      Chase. What a great name! Chase your customers away!

      I left them this week. The wife and I calculated the United rewards point we were supposedly accruing, versus the usurious increase in rates.

      Let us just say that with our balance, it is cheaper to buy points at the ticketing kiosk.

      Another bank we do business with will transfer the balance - at 0% for 1 year.

      --
      "Flyin' in just a sweet place,
      Never been known to fail..."
    4. Re:Wonderful. by FutureDomain · · Score: 1

      Can I charge them a $10 monthly fee for spam removal?

      No, but if you had a unique address for them at your own domain then you could bounce all the spam to one of their email addresses.

      --
      Hydraulic pizza oven!! Guided missile! Herring sandwich! Styrofoam! Jayne Mansfield! Aluminum siding! Borax!
    5. Re:Wonderful. by Anonymous Coward · · Score: 1

      My favorite conversation ever with a credit card company.

      "Hi my name is Jason, how can I help you."
      "Yes I would like to remove this yearly fee on my credit card."
      "I am not sure we can do that."
      "By the end of this call the yearly fee for this credit card will be gone."
      "Well sir by the terms of your contract we can not remove it."
      "I would like another credit card that does not have it then."
      "We can not do that right now."
      "By the end of this call the yearly fee for this credit card will be gone."
      "That is not possible to do."
      "Yes it is. I would like to cancel the card."
      "Oh yeah I guess that would get rid of the fee."

    6. Re:Wonderful. by DarkOx · · Score: 1

      Oh they had a reason, his name is Barney Frank and because he was going to make it nearly impossible for them to do it later they were forced to while the gettin was good. Also because you actually ready their correspondence carefully enough to be aware this happen you fall into a category called likely to pay on time and without the expensive strong arming by the collections department, so just encase you ever do have a balance past 30 days well they just might make few dollars of you.

      --
      Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
    7. Re:Wonderful. by v1 · · Score: 1

      I went through that call too. Twice. Both calls sparked by my reading the superfine print in the updated terms notice they sent me. First time, about 3 yrs ago, as yours went. Second time about 8 months ago, and they said thank you for your business, and transferred me to their cancellation department, which swiftly terminated my account without so much as a second glance.

      I was a little surprised by that, but owell. Not my loss. Was a little sad to see it go though, it was my first credit card while I was in college, had my photo and signature embedded on the front of the card. (made an awesome photo id) I don't carry a balance hardly ever anymore, (I'm not a "revolver") so they weren't making much off me, but they're not making anything off me now.

      --
      I work for the Department of Redundancy Department.
    8. Re:Wonderful. by KingAlanI · · Score: 1

      I've never had a credit card with them unlike some sibling commenters, but I've never particularly minded them for regular bank accounts

      The in-branch customer-service (teller transactions, etc.) of big banks generally isn't a problem, and that's most of what I deal with.

      The debit card rewards program is getting phased out with the new debit card fee regulations - very well, it's a logical response to their fees being cut. and what they were keeping would now accrue to the customer or retailer anyway.

      --
      I listen to both RIAA and non-RIAA stuff if I like the music, tangential business/politics nonwithstanding.
    9. Re:Wonderful. by nedlohs · · Score: 1

      You pay interest on credit cards?

      You're doing it wrong.

    10. Re:Wonderful. by Anonymous Coward · · Score: 0

      Chase hasn't screwed me over yet, but Capital One definitely has. They jacked my rate from 4.9 fixed to 17.9% variable before the new law took effect.

    11. Re:Wonderful. by Anonymous Coward · · Score: 0

      The CAN-SPAM act requires that they retain your email address for verification. In other words, they were just following the law.

    12. Re:Wonderful. by Jeremiah+Cornelius · · Score: 1

      Tell me bout it.

      --
      "Flyin' in just a sweet place,
      Never been known to fail..."
    13. Re:Wonderful. by Anonymous Coward · · Score: 0

      I cancelled my Chase accounts a month ago when they instituted a $120 a year fee on their 'Free Lifetime Checking' accounts.

      And yet they retained and leaked my email address.

      Can I charge them a $10 monthly fee for spam removal?

      Nope. They're required to retain your user records for at least 7 fiscal years under banking regulations.

  12. 4 FOr me by Anonymous Coward · · Score: 0

    4 - Chase, Best Buy, Robert Half, Ameriprise

  13. already a casualty by ArhcAngel · · Score: 1

    I just checked and somebody used my CITI card to buy several new large screen TVs and all sorts of electronic equipment. Guess I'll have to call this in....

    --
    "A person is smart. People are dumb, panicky dangerous animals and you know it." - K
    1. Re:already a casualty by Anonymous Coward · · Score: 1

      You used your CITI card number for your email address?

    2. Re:already a casualty by Anonymous Coward · · Score: 0

      You used your CITI card number for your email address?

      whoosh

    3. Re:already a casualty by Svartalf · · Score: 1

      No... Some clients gave out more info than they ought to and it sat on Epsilon's databases.

      --
      I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
    4. Re:already a casualty by ArhcAngel · · Score: 1

      While you are indeed correct I think the whoosh comment above is more fitting. Fortunately my cards thus far have been untainted. I will however be watching them like a hawk for the foreseeable future.

      --
      "A person is smart. People are dumb, panicky dangerous animals and you know it." - K
    5. Re:already a casualty by canajin56 · · Score: 1

      Epsilon said the breach was only names and email addresses, with the exception of a few clients who had member balances or other minor data included in their mailings (such as member points, where some sale flyers will tell you how many points you have to spend on these cool savings). CITI itself said the breach was only names and email addresses. So your conspiracy theory is that they are both lying, and the breach included credit card numbers. But, since both companies involved insist that they have checked and concluded it was only the mailing list, you must be getting your info from the other side! So, are you the hacker himself? Or are you just friends with the guys who stole this data?

      --
      ASCII stupid question, get a stupid ANSI
  14. Non-issue by Anonymous Coward · · Score: 0

    Just one apology from Best Buy with the subject "Important Email Security Alert" (Don't most phishers use that same subject line? But if Best Buy has my email address, it is already my spam email box, which was published on the web years ago (Thanks Eric S. Raymond! Googling that email address only returns 43 hits.)

  15. Two so far by Rob+the+Bold · · Score: 1

    So far I've gotten two. Best Buy and Home Shopping Network.

    I'd forgotten I'd even had accounts there. I wonder what other news of my past I'll be receiving this week.

    --
    I am not a crackpot.
  16. One from Robelt Half by wiredog · · Score: 3, Informative

    They have my email because they are tech headhunters, and I was unemployed a few years back.

     

    Dear Valued Customer,

    Today we were informed by Epsilon Interactive, our national email service provider, that your email address was exposed due to unauthorized access of their system. Robert Half uses Epsilon to send marketing and service emails on our behalf.

    We deeply regret this has taken place and any inconvenience this may have caused you. We take your privacy very seriously, and we will continue to work diligently to protect your personal information. We were advised by Epsilon that the information that was obtained was limited to email addresses only.

    Please note, it is possible you may receive spam email messages as a result. We want to urge you to be cautious when opening links or attachments from unknown third parties. We ask that you remain alert to any unusual or suspicious emails.

    As always, if you have any questions, or need any additional information, please do not hesitate to contact us at customersecurity@rhi.com.

    Sincerely,

    Robert Half Customer Care

    1. Re:One from Robelt Half by sajuuk · · Score: 1

      Same here, I totally forgot I had applied for a job through them when I was hunting for work right out of college.

    2. Re:One from Robelt Half by Anonymous Coward · · Score: 0

      yep. same here. recruiters suck.

    3. Re:One from Robelt Half by Anonymous Coward · · Score: 0

      Yep, got one from Robert Half too. Wrote them that I'm disappointed in their handling of my private info.

  17. Email encryption by rwa2 · · Score: 1

    Wasn't stuff like PGP / GPG supposed to solve all of email's problems by allowing people to use real email whitelists? Is there any effort to use public-private keyrings to sign email, so we can simply filter out all the spam that isn't signed by someone we don't know? If we actually used this stuff, they'd just have to revoke their private key (if it was among the data compromised) issue a new one (along with the apology) and be done... the email addresses wouldn't be of much further use to a spammer if people/procmail just ignored unsigned emails.

    I'd hate to think that Facebook might become the de-facto replacement for email just because most of the webmail providers don't make it easier to set all that encryption stuff up.

    1. Re:Email encryption by Chemisor · · Score: 1

      Having webmail provide encryption has one obvious problem: you have to give the webmail provider your secret key, implying a level of trust you probably do not have for them. You could, of course, use Thunderbird and Enigmail, but that still will not help you check your mail on any computer that isn't yours. Then there's the hassle of convincing your friends to use encryption. That task pretty much becomes impossible once you mention that a passphrase will henceforth be required to send email. GPG goes to incredible lengths to prevent people from not setting a password on the secret key; an option that would have allowed me to enable encryption transparently. (Yeah, yeah, it's a security risk, but you know what? The threat of a local attack is exactly zero for most people) With all these inconveniences it is no wonder nobody does email encryption when it is so much easier to use plain webmail and not worry about it.

    2. Re:Email encryption by rwa2 · · Score: 1

      Oh, I don't know... it was pretty easy to set up a hushmail account just now, just to see what it was like. It just uses your password as the passphrase, so it was pretty straightforward. Only 2MB for the free account, which expires after 3 weeks of inactivity, so it's of limited use, but I don't really see why the other big webmail providers couldn't follow suit.

      I don't see a reason not to have a separate secret key per email account, so I'd never really have to give them whatever I considered my "main" keypair. And if you did want to use your own local secret key, I'm sure there's something they could do with java or maybe even javascript to let you encrypt locally.

      They even have a question / answer challenge that they use to send email to accounts that don't support encryption (the recipient just gets a link back to the hushmail https site to view the message). I think after coping with something like that for a bit, your friends will start using the service as well.

      Email signatures and encryption has been around for decades, and yet we're still here complaining about spam :-P But my real fear is that people will stop using email and all move to facebook or some godforsaken social network. (the tweens already only send texts, email is for "old people" :P )

    3. Re:Email encryption by dgatwood · · Score: 1

      Having webmail provide encryption has one obvious problem: you have to give the webmail provider your secret key, implying a level of trust you probably do not have for them.

      There's a second option. The webmail service could generate its own public and private key pair, and you can sign that pair with your personal key. You could then separately revoke the webmail key. Nothing says that a person can only have one PK crypto key pair.

      There's a third option, too. The webmail service could use a secure callback to your home computer, and that computer could do the signing on your behalf, using "Back to my Mac" or similar so that you don't have to leave your home machine running all the time. You could then revoke permission for the webmail service to do so at any time.

      --

      Check out my sci-fi/humor trilogy at PatriotsBooks.

  18. My stock reply: by nitehawk214 · · Score: 1

    To every one of these I send this reply:

    I hold your company directly responsible for this breach of privacy. I do not care that you place the blame with a 3rd party company.

    I encourage everyone who receives these apology emails to do the same. Perhaps companies will care about privacy. (Ok, I don't really believe that. But it is a good test to see if anyone actually reads replies to these emails.)

    --
    I'm a good cook. I'm a fantastic eater. - Steven Brust
    1. Re:My stock reply: by jaymz666 · · Score: 1

      Is it ironic that they used Epsilon to send these warning emails from?

    2. Re:My stock reply: by Anonymous Coward · · Score: 0

      You didn't expect them to stop, did you?

    3. Re:My stock reply: by gEvil+(beta) · · Score: 1

      Is it ironic that they used Epsilon to send these warning emails from?

      These companies didn't send these warning emails. Epsilon sent them for them on their behalf. There is a difference.

      --
      This guy's the limit!
  19. So far 3, but many more companies that I deal .... by cjdavis618 · · Score: 0

    with haven't notified me. This is more troublesome than the ones that have. I don't really worry about spam overall, but the like others said, the lack of credible information about the issue is annoying. Epsilon should be notifying us directly and furthermore, most of these companies agreed not to share our information with outside firms for marketing. Doesn't Epsilon qualify as an outside firm for marketing?

  20. I wonder... by jaymz666 · · Score: 2

    Did they use Epsilon to send out the security alert warning emails?

    >Received: from
    > by pimta03.epsiloninteractive.com

    Looks like it.... Hmmm... what does that say about it?

    1. Re:I wonder... by Rob+the+Bold · · Score: 1

      Did they use Epsilon to send out the security alert warning emails?

      >Received: from > by pimta03.epsiloninteractive.com

      Looks like it.... Hmmm... what does that say about it?

      If I were Best Buy or whoever, I would be telling Epsilon "you broke it, you fix it." Which in this case means -- at a minimum -- sending out these notices. So I'm really not surprised. Maybe surprised little at first.

      --
      I am not a crackpot.
    2. Re:I wonder... by jank1887 · · Score: 1

      I'm willing to bet Epsilon's not charging them for these mailings.

    3. Re:I wonder... by jaymz666 · · Score: 1

      yeah, I guess they already lost all the information, so why stay open to it and send even more messages

  21. I've got three. by Ecuador · · Score: 1

    Disney Destinations, New York & Company, AbeBooks. I'm waiting to see how these addresses (each being a different one of course) will get used. Will it be spam, trojans, nigerian princes or something new and exciting? ;)

    --
    Violence is the last refuge of the incompetent. Polar Scope Align for iOS
    1. Re:I've got three. by oh-dark-thirty · · Score: 1

      I got one from New York & Company, and honestly had no clue I was even on their list...!

  22. Tivo by Xian97 · · Score: 1

    I received one from Tivo, and I haven't been a customer for over 2 years. I guess they still had my account info stored. It was actually my father's account, but since he doesn't have a computer we used my contact info.

    1. Re:Tivo by jank1887 · · Score: 1

      that's my great-grandfather's email address. sure we've changed the domain once and the username twice, but it's still my grandfather's email address.

  23. Only one email... by Cl1mh4224rd · · Score: 1

    I've only received one from US Bank on April 2 (two days ago). It was the first I had heard of the incident.

    --
    People will pass up steak once a week, for crap every day.
  24. Nothing, yet. by ackthpt · · Score: 1

    I'm certain to receive at least one, which really does little to console me after the years of being spammed by the "legit" holders of my email addresses. This is why we have Gmail junk bucket accounts...

    "Why, yes! I do have an email address for your bulletins and offers, it's [...]@gmail.com! (which I check once every blue moon or so)"

    --

    A feeling of having made the same mistake before: Deja Foobar
  25. I've had spam by the thousands for 2 weeks... by kaizendojo · · Score: 1

    and only found out why on Saturday.

  26. Your stock reply don't mean squat. by Anonymous Coward · · Score: 0

    a) nobody at the "institution" gives a flying sh_t what you think.
    b) nobody at the "institution" reads the replies from mass e-mail anyways.
    c) nobody at the "institution" is sincere about that apology anyhow.

    if you want to get their attention, get your torch and pitchforks out and storm the headquarter of the "institution." that will get their undivided attention REAL FAST (for a fraction of a minute,) of course, you might get shot by their rent-a-cop or the local PD...

    1. Re:Your stock reply don't mean squat. by nitehawk214 · · Score: 1

      Well the email to Best Buy bounced. So yeah, they really don't give a shit to the point where they don't even pretend to accept replies.

      --
      I'm a good cook. I'm a fantastic eater. - Steven Brust
  27. Notification by pavon · · Score: 1

    It is useful to let you know that your information has been compromised so you can take any appropriate action. The apology is just extra words, not the purpose of the communication.

  28. As if you need to ask... by ackthpt · · Score: 1

    Re:How does this happen?

    I have received these from Best Buy and TiVo so far.

    Seriously, why do all these companies outsource to such a crappy company that in one breach ALL their email lists get compromised? Does it really save them money to not operate the mailing lists themselves?

    Cut costs, take lowest bidder, require no proof of secure measures in place or review of procedures - it's not always incompetence by the peons who build the systems, usually it's incompetence and avarice by those who remove or never hire the sort of positions which oversee data security and integrity.

    --

    A feeling of having made the same mistake before: Deja Foobar
    1. Re:As if you need to ask... by Anonymous Coward · · Score: 1

      American business would outsource baby care to rabid Tasmanian Devils if the bean-counters said it would save 25 cents per thousand served.

  29. Another post, another datapoint by Anonymous Coward · · Score: 0

    I can see them going "Let me just store in my little database that "HTH NE1 (675604)" is overly concerned and probably a good spam target for anti-anxiety meds".

    Just to be clear: EVERYTHING you post on the net gives someone, somewhere just a little bit of extra information. It all adds up. You've got that one right.

    1. Re:Another post, another datapoint by sexconker · · Score: 1

      I can see them going "Let me just store in my little database that "HTH NE1 (675604)" is overly concerned and probably a good spam target for anti-anxiety meds".

      Just to be clear: EVERYTHING you post on the net gives someone, somewhere just a little bit of extra information. It all adds up. You've got that one right.

      While it all adds up, it's pretty easy to make the weight of many of those pieces negative by putting in false info wherever possible, thus confusing the beast.

      - Rusty Shackleford

  30. One from Chase by Anonymous Coward · · Score: 0

    I got this email from Chase:

    Note: This is a service message with information related to your e-mail address.

    Chase is letting our customers know that we have been informed by
    Epsilon, a vendor we use to send e-mails, that an unauthorized
    person outside Epsilon accessed files that included e-mail addresses
    of some Chase customers. We have a team at Epsilon investigating
    and we are confident that the information that was retrieved included
    some Chase customer e-mail addresses, but did not include any
    customer account or financial information. Based on everything we
    know, your accounts and confidential information remain secure. As
    always, we are advising our customers of everything we know as we
    know it, and will keep you informed on what impact, if any, this
    will have on you.

    We apologize if this causes you any inconvenience. We want to
    remind you that Chase will never ask for your personal information
    or login credentials in an e-mail. As always, be cautious if you
    receive e-mails asking for your personal information and be on the
    lookout for unwanted spam. It is not Chase's practice to request
    personal information by e-mail.

    s a reminder, we recommend that you:
    - Don't give your Chase Online(SM) User ID or password in e-mail.

    - Don't respond to e-mails that require you to enter personal
        information directly into the e-mail.

    - Don't respond to e-mails threatening to close your account if you do
        not take the immediate action of providing personal information.

    - Don't reply to e-mails asking you to send personal information.

    - Don't use your e-mail address as a login ID or password.

    The security of your information is a critical priority to us and we
    strive to handle it carefully at all times. Please visit our Security
    Center at chase.com and click on "Fraud Information" under the "How to
    Report Fraud."
    http://notifications1.chase.com/244387027.3709.0.782
    It provides additional information on exercising caution
    when reading e-mails that appear to be sent by us.

    Sincerely,

    Patricia O. Baker

    Senior Vice President

    Chase Executive Office
    ----

    If you want to contact Chase, please do not reply to this message,
    but instead go to Chase Online. For faster service, please enroll or
    log in to your account. Replies to this message will not be read or
    responded to.

    Your personal information is protected by advanced technology. For
    more detailed security information, view our Online Privacy Notice:
    http://notifications1.chase.com/244387027.3709.0.563
    To request in writing: Chase Privacy Operations, P.O. Box 659752,
    San Antonio, TX 78265-9752.

    JPMorgan Chase Bank, N.A. Member FDIC
    (C) 2011 JPMorgan Chase & Co.

    LCEPAEM0311

    1. Re:One from Chase by KingAlanI · · Score: 1

      Yeah, that's the same email I got from Chase

      --
      I listen to both RIAA and non-RIAA stuff if I like the music, tangential business/politics nonwithstanding.
  31. Since when is sincerety a requirement? by Chemisor · · Score: 1

    When someone asks you "how are you?", you know, just like everybody else, that the question is not sincere. Both you and the questioner expect an answer along the lines of "I'm fine", even if you're on your death bed. Both the question and the answer are merely part of the social protocol; give a token, get a token. It may seem pretty dumb, but it has worked just fine for centuries, and heck, without empty chit-chat what would people talk about?

    1. Re:Since when is sincerety a requirement? by Anonymous Coward · · Score: 1

      When someone asks you "how are you?", you know, just like everybody else, that the question is not sincere.

      Speak for yourself. I know that it makes people feel better, because I can see their expression change, to have someone ask how they're doing, and when they do take the time to answer I usually find it interesting. I certainly have more pleasant and fewer stressful interactions with people, so on a day to day basis it makes my life better.

      There is a caveat: you do have to make a conscious effort to be ready to stop and listen and take an interest in what they have to say. If you're actually in a hurry and you cut someone off, you'll definitely come across as insincere or patronizing.

    2. Re:Since when is sincerety a requirement? by Bill+Dog · · Score: 1

      Both you and the questioner expect an answer along the lines of "I'm fine"

      I like to answer truthfully, and bum the unsuspecting person out.

      --
      Attention zealots and haters: 00100 00100
  32. Brave New Marketing Services by AdamThor · · Score: 4, Funny

    Arrrrg! Freaking Epsilons! Never send an Epsilon to do Alpha work, I guess.

    --
    -- "Oh. This guy again."
    1. Re:Brave New Marketing Services by dstyle5 · · Score: 1

      Don't blame the Epsilons, even Alphas can have their blood-surrogate tainted before decanting.

    2. Re:Brave New Marketing Services by Anonymous Coward · · Score: 0

      Here, have some Soma.

    3. Re:Brave New Marketing Services by AdamThor · · Score: 1

      *glances involuntarily at Bernard*...

      --
      -- "Oh. This guy again."
    4. Re:Brave New Marketing Services by Anonymous Coward · · Score: 0

      Deucalion would be pissed at you for even insinuating that you should use any of them!

    5. Re:Brave New Marketing Services by Anonymous Coward · · Score: 0

      Arrrrg! Freaking Epsilons! Never send an Epsilon to do Alpha work, I guess.

      But the Beta's are office work guys :(

    6. Re:Brave New Marketing Services by Anonymous Coward · · Score: 0

      Finally! It's been years since I've seen a comment worthy of a laugh on Slashdot.

  33. One from Citi this morning... by sillivalley · · Score: 1

    Citi hasn't been doing too well on these things recently; they've replaced our cards twice in the last few months.

    Outsourcing saves companies money because the outfit that takes the business can achieve better economies of scale -- yeah, they can compromise tens of millions of accounts at once for multiple firms, rather than the measly million or two that would have been screwed otherwise...

  34. Re:credit card PIN and 3 digit verifier compromise by Eric(b0mb)Dennis · · Score: 1

    Check it out, there's no catch all 'criminal database' full of people's credit cards and PIN numbers. If this was the case, a group could simply use this list to make everyone aware of the impending fraud...

    Most 'carding' activity is done via forums and IRC.. where credit card dumps (dumps of the magnetic strip) and numbers/info are SOLD for anywhere from $1-$5 each, depending on the value of the card in question.. and if it's a dump or just information. The dumps can be used to 'write' the information to blank magstrips (other credit cards, hotel key cards) with the right hardware.

    The only way these criminals withdrew the money from your account was with your PIN number. The fraud officer was right. You can make purchases without a PIN using the credit aspect of a card, but you CANNOT withdraw money.. You can't even get 'cash back' without using the ATM part of the card. Somewhere along the lines you must've disclosed your PIN number. Can't you contact the establishments where the money was taken (where teh ATM or whatever device was used to obtain the money) they almost universally have cameras on them now.. for the fact that you can say 'that wasn't me' and request a camera shot of the person taking the money out... with that evidence in hand it's usually very easy from there to get the charges removed.

    --
    Excuse me, I don't mean to impose, but I am the ocean
  35. Good thing I use unique passwords. by Anonymous Coward · · Score: 0

    I've gotten two emails today... One from TiVo, and one from Chase Bank.

    Thrilling.

  36. NONE. by neo · · Score: 0

    Thankfully I don't work for any of those slave shops. I knew I should have taken the blue pill.

  37. Is it a breach? by dir-wizard · · Score: 1

    .. If the client companies already sold their email lists to various marketing firms?

    1. Re:Is it a breach? by Skapare · · Score: 1

      And so begins the mass mailings from Epsilon's secret Chinese and Russian subsidiaries.

      --
      now we need to go OSS in diesel cars
  38. Doesn't matter by Zoinky · · Score: 1

    I use two email addresses, one that I provide to companies that I do business with, and one that I use for personal correspondance and everywhere else online (public forums, etc.). The "business" email has always received much more spam than the one I use and give out liberally everywhere else online. Looks to me like they're just sorry that someone got my email address for free, rather than them being able to sell my address to another one of their "partners".

  39. Collegeboard.com by sconeu · · Score: 1

    Only one so far

    --
    General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
  40. The answer by Anonymous Coward · · Score: 0

    How many apology emails have you got so far today?

    Three. I made sure I was removed from their lists.

  41. Citi by Flyers2391 · · Score: 1

    I haven't seen Citi mentioned in anything I've read yet, I received an email from them a little while ago:

    Dear [Flyers2391],

    Recently, Citi was notified of a system breach at Epsilon, a third-party vendor that provides marketing services to a number of companies, including Citi. The information obtained was limited to the customer name and email address of some credit card customers. No account information or other information was compromised and therefore there is no reason to re-issue a new card.

    Because e-mail addresses can be used for "phishing" attacks, we want to remind our customers of the following:

            * Citi Cards uses an Email Security Zone in all of our email to help you recognize that the email was sent by us. Customers should check the Email Security Zone to verify that the email you received is from CIti and reduce the risk of personal information being "phished". To help you recognize that the email was sent by Citi we will always include the following in the Email Security Zone in the top headline portion of all our emails:
                        o Your first name and last name
                        o Last four digits of your Citi card account number
                        o And recently to increase security, we have added your “member since” date located on the front of your card, where available.

            * ThankYou(SM) Rewards always includes your first name, last name, last four digits of your ThankYou Member ID, and Total Available Point Balance in the top headline portion of all our emails to help you recognize that the email was sent by us. Customers should check the top portion to verify that the email they have received is from ThankYou(SM) Rewards and reduce the risk of personal information being "phished".
            * More information about phishing is available here: [link]

  42. This is great by Anonymous Coward · · Score: 0

    Working for a competitor to Epsilon, this is GREAT news!!!

  43. footer to the Chase email by KingAlanI · · Score: 1

    If you want to contact Chase, please do not reply to this message, but instead go to Chase Online. For faster service, please enroll or log in to your account. Replies to this message will not be read or responded to.

    Honestly though, I just don't feel myself getting worked up over this stuff (although there are more-serious privacy issues)

    --
    I listen to both RIAA and non-RIAA stuff if I like the music, tangential business/politics nonwithstanding.
  44. Any Robert Half consultants out there? by Anonymous Coward · · Score: 0

    They got us, too...

    >>>
    Dear Valued Customer, (not a customer, I'm an employee, so they got hit as well)

    Today we were informed by Epsilon Interactive, our national email service provider, that your email address was exposed due to unauthorized access of their system. Robert Half uses Epsilon to send marketing and service emails on our behalf.

    We deeply regret this has taken place and any inconvenience this may have caused you. We take your privacy very seriously, and we will continue to work diligently to protect your personal information. We were advised by Epsilon that the information that was obtained was limited to email addresses only.

    Please note, it is possible you may receive spam email messages as a result. We want to urge you to be cautious when opening links or attachments from unknown third parties. We ask that you remain alert to any unusual or suspicious emails.

    As always, if you have any questions, or need any additional information, please do not hesitate to contact us at customersecurity@rhi.com.

    Sincerely,

    Robert Half Customer Care

    Robert Half Finance & Accounting
    Robert Half Management Resources
    Robert Half Legal
    Robert Half Technology
    The Creative Group
    >>>

  45. Two by KingAlanI · · Score: 1

    one from Chase (posted about it in another comment)

    one from AbeBooks (one of my occasional used-textbook sources):

    Epsilon Informs AbeBooks of E-mail Database Breach

    We have been informed by Epsilon, a third-party vendor we use to send e-mails, that an unauthorized person outside their company accessed files that included e-mail addresses of some AbeBooks customers. Epsilon has advised us that the files that were accessed did not include any customer information other than email addresses.

    As a reminder, AbeBooks will never ask customers for personal or account information in an e-mail. Please exercise caution if you get any emails that ask for personal information or direct you to a site where you are asked to provide personal information.

    AbeBooks Newsletter. Copyright © 2011 AbeBooks Inc. Suite 500 - 655 Tyee Road, Victoria, BC, V9A 6X5, Canada. All rights reserved.

    If you have any questions, our Customer Support team will be happy to help.

    --
    I listen to both RIAA and non-RIAA stuff if I like the music, tangential business/politics nonwithstanding.
  46. If A Company Cannot Run Its Own Mail Servers, by Anonymous Coward · · Score: 1

    It is not worth doing business with. Nothing looks cheesier than an email from a financial institution or a law firm that was sent from some crappy third party mail service.

    Perhaps the worst one I ever saw was a mass emailing from a group of Seattle patent attorneys trumpeting how serious they were about confidentiality.
    They had, of course, just exposed their entire client list to a third party emailer.

  47. corporate persons and human rights by manaway · · Score: 1, Interesting

    Oh, come on now, let's be fair, they're all really quite sorry...

    ...sorry the public was made aware of the breach.

    Don't forget, they also "regret this has taken place" in the public eye and "are working diligently... and continue to protect your personal information" by sharing your info with Experian, TransUnion, Equifax, and ChoicePoint every month; along with the occasional publicized data breach. So there you have it, a sorry, a regret, and a things will continue. You can go back to using your accounts and rest assured they are as safe as they ever were. Whatever that means.

    Whenever you or I lose a company laptop, violate a contract, disclose a non-disclosure agreement, expose a sealed order, blow the whistle on environmental violations, expose internal corporate corruption, we are harangued, demoted, sued, fined, fired, jailed, or blacklisted. Maybe the difference between being a human and a corporation having the same rights as a person hasn't worked out and is slowly changing?

  48. BestBuy is also affected (appears so, see inside) by Anonymous Coward · · Score: 0

    I just got a letter via email today in regards to my subject-line above. It appears that BestBuy has also been affected (some "FYI" for anyone that does their shopping there, even if only occasionally like myself).

    APK

    P.S.=> CONTENT OF EMAIL FROM BESTBUY & PERTINENT EXCERPT QUOTED VERBATIM FOR READERS' REFERENCE:

    ---

    "Important Email Security Alert Dear Valued Best Buy Customer, On March 31, we were informed by Epsilon, a company we use to send emails to our customers, that files containing the email addresses of some Best Buy customers were accessed without authorization. We have been assured by Epsilon that the only information that may have been obtained was your email address and that the accessed files did not include any other information. A rigorous assessment by Epsilon determined that no other information is at risk. We are actively investigating to confirm this. For your security, however, we wanted to call this matter to your attention. We ask that you remain alert to any unusual or suspicious emails. As our experts at Geek Squad would tell you, be very cautious when opening links or attachments from unknown senders. In keeping with best industry security practices, Best Buy will never ask you to provide or confirm any information, including credit card numbers, unless you are on our secure e-commerce site, www.bestbuy.com. If you receive an email asking for personal information, delete it. It did not come from Best Buy. Our service provider has reported this incident to the appropriate authorities. We regret this has taken place and for any inconvenience this may have caused you. We take your privacy very seriously, and we will continue to work diligently to protect your personal information. For more information on keeping your data safe, please visit:

    Sincerely,

    Barry Judge
    Executive Vice President & Chief Marketing Officer
    Best Buy
    BestBuyRewardZone@emailinfo.bestbuy.com " ... apk

  49. received an apology email from Hilton Honors today by Anonymous Coward · · Score: 0

    received an apology email from Hilton Honors today

  50. apology e-mail by applematt84 · · Score: 1

    I actually received an apology from Disney on Apr 3rd ... the first of any message. It wasn't until today that I received messages from three other vendors. Disney seems to be on top of it ... so I wonder why the delay from the other vendors? What's funny though, is Google Mail thought the apology from Disney was spam!

  51. And here I thought it was Rustock recovering by Caerdwyn · · Score: 1

    This explains the huge pop I saw in incoming spam to my personal account that started on March 31 and which is continuing.

    Yet another reason to avoid Capital One: they sell your email to barely-legal spammers err... "marketing partners" at every opportunity, despite asking for opt-out.

    --
    Everybody gets what the majority deserves.
  52. Facebook? by Anonymous Coward · · Score: 0

    The first thing that came to my mind...check Mark Zuckerberg. That dude is totally black hat,

    1. Re:Facebook? by mrxak · · Score: 1

      Your post-ending comma is going to bother me all day.

  53. Chase Letter a perfect phishing template! by MarcAuslander · · Score: 1

    Got my Chase letter. It warns about not sending information by email. Nothing about not clicking on links. In fact, it contains the lines:

    The security of your information is a critical priority to us and we strive to handle it carefully at all times. Please visit our Security Center at chase.com and click on "Fraud Information" under the "How to Report Fraud." It provides additional information on exercising caution when reading e-mails that appear to be sent by us.

    chase.com is a link!

    All a phisher needs to do is send this exact email, pointing to a dummy Chase page, and encourage the victim to log in when he reaches it.

    Clearly they are either very stupid or really just don't care. I'll go for the latter.

  54. Re:Received one this morning. [Target] by Anonymous Coward · · Score: 0

    If target hasn't been linked:

    To our valued guests,

    Target’s email service provider, Epsilon, recently informed us that their data system was exposed to unauthorized entry. As a result, your email address may have been accessed by an unauthorized party. Epsilon took immediate action to close the vulnerability and notified law enforcement.

    While no personally identifiable information, such as names and credit card information, was involved, we felt it was important to let you know that your email may have been compromised. Target would never ask for personal or financial information through email.

    Consider these tips to help protect your personal information online:
    Don’t provide sensitive information through email. Regular email is not a secure method to transmit personal information.
    Don’t provide sensitive information outside of a secure website. Legitimate companies will not attempt to collect personal information outside a secure website. If you are concerned, contact the organization represented in the email.
    Don’t open emails from senders you don’t know.
    We sincerely regret that this incident occurred. Target takes information protection very seriously and will continue to work to ensure that all appropriate measures are taken to protect personal information. Please contact Guest.Relations@target.com should you have any additional questions.

    Sincerely,

    Bonnie Gross
    Vice President, Marketing and Guest Engagement

  55. I've gotten 2 today by Anonymous Coward · · Score: 0

    I've received 2 apology emails today. One from collegeboard, one who handles my ACT info, and then one from my credit card company. I'm not worried about it personally because I don't fall for phishing, I don't even believe the real emails...

  56. If they don't do this, they owe you $3000... by elvey · · Score: 1

    ...if they were willful, intentional, or reckless, and if they weren't, they still owe you $500 if you ask them to disclose to you any personal information disclosures and they don't. In either case, this only applies if you're Californian.

    The relevant law is CALIFORNIA CIVIL CODE SECTION 1798.80-1798.84 which you can find here:
    http://www.leginfo.ca.gov/cgi-bin/displaycode?section=civ&group=01001-02000&file=1798.80-1798.84
    (1798.83 and 1798.84 are the most relevant.)

    I'm currently (still!) suing TD Ameritrade for covering it up when they were hacked and the names, addresses, SOCIAL SECURITY NUMBERS, etc, of 6.4 MILLION customers were compromised. (See amtd.elvey.com.) ...
          (b) Any customer injured by a violation of this title may
    institute a civil action to recover damages.
          (c) In addition, for a willful, intentional, or reckless violation
    of Section 1798.83, a customer may recover a civil penalty not to
    exceed three thousand dollars ($3,000) per violation; otherwise, the
    customer may recover a civil penalty of up to five hundred dollars
    ($500) per violation for a violation of Section 1798.83.. ...and you can file for an injunction to force them to disclose.

    --
    Make 'em pay! http://Payola.org #include "stddisclaimer
  57. Reckless use of something they don't own by hwstar · · Score: 1

    First, all of these companies passed off the task of marketing to Epsilon, then Epsilon had a 'chink' in their armour, and user names and Email addresses were stolen. Sounds to me like the bad guys knew that the best way to get this information was to attack an aggregator such as Epsilon. All of these companies which use aggregators such as Epsilon, are doing something that they should never do without your express permission: divulging your personal information.

    The current system of privacy pamphlets being mailed out by companies periodically is a utter joke. There are so many loopholes you can drive the starship enterprise right though them.

    We need a centralised 'do not divulge list' which could be an expansion of the current 'do not call list' for telephone numbers. Why not expand it so that you can enter email address, and street addresses. Anything entered on this 'do not divulge list' would be off limits for marketing purposes.

    Write your US congresspersons and senators (I did)

  58. Marriott Hotels by Anonymous Coward · · Score: 0

    I received this from the Marriott Hotel Chain:

    April 4, 2011

    Dear Marriott Customer,

    We were recently notified by Epsilon, a marketing vendor used by Marriott International, Inc. to manage customer emails, that an unauthorized third party gained access to a number of Epsilon's accounts including Marriott's email list.

    In all likelihood, this will not impact you. However, we recommend that you continue to be on the alert for spam emails requesting personal or sensitive information. Please understand and be assured that Marriott does not send emails requesting customers to verify personal information.

    We take your privacy very seriously. Marriott has a long-standing commitment to protecting the privacy of the personal information that our guests entrust to us. We regret this has taken place and apologize for any inconvenience.

    Please visit our FAQ to learn more.

    Sincerely,

    Marriott International, Inc.

    .

  59. I have gotten 4 by Anonymous Coward · · Score: 0

    4 already!!!

  60. CloseYourChaseAccount by Anonymous Coward · · Score: 0

    Wow. Spam. Is this for real? Delete it and move on, or is this considered important? If so, I fail to see how/why

  61. Received this from Walgreen by Anonymous Coward · · Score: 0

    Dear Valued Customer,

    On March 30th, we were informed by Epsilon, a company we use to send emails to our customers, that files containing the email addresses of some Walgreens customers were accessed without authorization.

    We have been assured by Epsilon that the only information that was obtained was your email address. No other personally identifiable information was at risk because such data is not contained in Epsilon's email system.

    For your security, we encourage you to be aware of common email scams that ask for personal or sensitive information. Walgreens will not send you emails asking for your credit card number, social security number or other personally identifiable information. If ever asked for this information, you can be confident it is not from Walgreens.

    We regret this has taken place and any inconvenience this may have caused you. If you have any questions regarding this issue, please contact us at 1-855-814-0010. We take your privacy very seriously, and we will continue to work diligently to protect your personal information.

    Sincerely,

    Walgreens Customer Service Team

  62. anotherOne by Anonymous Coward · · Score: 0

    It seems BofA is not so ready to admit where the breach came from, but I certainly received a letter and a new debit card, indicated there had been a third party breach. This along with the numerous other emails I received regarding Epsilon email breach, leads me to believe they do not want anyone to know who they utilize for services.

  63. ONLY my name and email address?! by Anonymous Coward · · Score: 0

    Didn't really count, but at least five notices today. The average Joe / Jane doesn't (want to) keep multiple email addresses, build spam filters, spend any time with this crap. Luv'd a previous comment, "Did CitiCorp, Chase, BestBuy... use Epsilon to send out the warning notices of the breach?" These people are bottom feeders.

  64. Christin McMeley of Charter Sent Me an E-mail by IgnacioB · · Score: 1

    Just got mine from Christin McMeley of Charter Communications. Conspiciously, it didn't really answer any of my questions nor did they provide any contact information other than a generic www.charter.com/security website totally silent on the subject. When I tried to call Charter they had zero clue about it and thought I had been phished and suggested ignoring the e-mail. Reluctantly and with at least 20 minutes of phone tech and manager consternation they transferred me to their privacy department and ended in a voicemail I have zero faith I'll get a call back on. Rather annoyed I decided to find Ms. McMeley directly and totally surprised to find her actual personal phone number via Google and an incident where they had....wait for it.....reported 12 stolen laptops with personnel data in 2008. http://www.oag.state.md.us/idtheft/Breach%20Notices/ITU-157541.pdf And when I called the number...I got Ms. McMeley's cheery voicemail...in her own voice! That alone was great satisfaction to just leave a message...and asked her nicely to give me a call back on this most important issue. I'm still waiting, but cautiously optimistic she or a staffer will call. And if not...I'll persevere until they explain why my data was stolen when I asked them expressly to not share my personal data with anybody. And if that doesn't work wonder if those fine folks at anonymous are busy?

    1. Re:Christin McMeley of Charter Sent Me an E-mail by IgnacioB · · Score: 1

      Just a follow-up, but I got a call back from a staffer saying I'd receive a direct phone call from Ms. McMeley. Impressive actually.... I did share with the staff person the specific question I had about why they'd share information with a third party when i've asked the specifically not to...and that if they send out an apology e-mail they need to include contact information and to share it with their whole company including phone staff. We'll see how it goes....

  65. bfg fgdf by Anonymous Coward · · Score: 0

    planchas ghd Hair Straightener last IV curling promise, movies and waves, and perfectly straight hair. What? GHD hair irons makes plancha del pelo ghd ceramic the test to see if it can ensure that each day is a good hair plates day.GHD launched for sale in limited edition pink Taylor that there must be an attachment in GHD IV Styler the packaging, including a heat resistant bag, a hairbrush, hair clips a. This pack comes with a warranty of two years, ghd IV sets, free delivery and 10 of each purchase will go to a charity for breast cancer research.
            Every girl wants to be the envy of your friends and have a product, ghd Hair Straightener, and a sort of limited series.Busy Scissors is a game produced by Little orbit hair, GHD South Africa, Redken LLC, which allows players of color, shampoo, cut, dry hair and style, while trying to achieve their virtual exhibition of his son. This ghd Hair Straightener Kiss Pink industry is the first video game, supported, enabling players to get something that is quite realistic in the field, allowing players to create realistic hair and jackets styles.moncler hairnew sale, Moncler coat, moncler jackets are selling children in the factory. onlinehere moncler Quilts with free shipping