Slashdot Mirror
The Register Email Address Blunder
First time accepted submitter Tim99 writes "This morning I got an email from The Register informing me that they have sent 3,521 of their readers the names and e-mail addresses of 46,000 other readers. Considering their frequent rants about security this has got to be a major FAIL."
El Reg writes: "Obviously, this was an error. The two-stage send process that is the norm for all of our mailers was over-looked because someone was in a hurry."
"We are in the process of blowing the whistle on ourselves to the ICO over the matter."
"The dew has clearly fallen with a particularly sickening thud this morning"
They've put their money where their mouth is, and reported themselves to the Information Commisioner's Office for the breach.
No kidding!!! What do you say at this point?
The impacts of this on the Reg readers affected is probably fairly minimal. At worst, the volumes of spam headed towards certain e-mail addresses will increase. But then - how many people these days really use an e-mail address for their website-registrations that they don't expect to be a complete spam-magnet anyway.
But there's no credit card info out there, no real-world addresses or telephone numbers. And having an account with The Register isn't the kind of thing that people tend to lose their jobs over, so nobody need be particularly embarrassed about their name being on the list (unlike, say, when the British National Party's membership list was leaked a while back).
This is far worse for The Register itself. It has - quite rightly - been a prominent critic of companies or organisations who fail to protect personal data. And now - even though the breach is at the lowest end of the severity scale - it's gone and done it itself. Fairly or not (and it's probably not, since I doubt it was one of the actual writers who was responsible for this), their own credibility is tarnished.
UK readers may remember Angus Deayton of Have I Got News For You fame. I can see the potential for similar consequences here...
Check the comments to the Reg's own story. One of their readers has already taken great delight in uploading it - prompting an angry reaction from everybody else on the comments. After all, the Reg's actions, however stupid, were accidental. Posting a bunch of people's e-mail addresses to pastebin is deliberate malice (even if it was probably inevitable with that many recipients).
Well, it seems likely that some register users will be getting a lot of spam soon. Even if the list didn't get sent directly to a spammer it might have gone to someone who wants to teach the Register an important lesson.
I always use disposable addresses when signing up for anything, and even give them to my friends. I've had one Linux forum make my address publicly visible. I've had multiple vendors send out things to lists with CC information in plain sight. I've had friends who had their accounts hacked and their contact information harvested. Always using disposable addresses lets you cut off just the problem rather than having to abandon an entire e-mail account (which I had to do years ago when it suddenly started receiving hundreds of e-mails a day, so much that my normal e-mail was being rejected because my "mailbox was full")..
I use a great free service from Spamgourmet.com. I have no relationship with them other than being a satisfied user for many years. As far as I know my actual e-mail (which I obviously had to give to them for forwarding) has never been compromised or leaked and I've never received any form of junk mail from them. They are not the only such option, but whichever you choose to use you should definitely use one if you want to protect yourself from spam and worse.
I'm an American. I love this country and the freedoms that we used to have.
If he'd stayed, then for years to come, every time he tried to mock any of his guests over their own indiscretions, they could just have turned the tables on him. HIGNIFY has always had a degree of "yah boo sucks" about it - it's not exactly reasoned debate - and this would have amounted to a get-out-of-jail-free card for guests. Having the show run on that basis in the long run would have robbed it of most of its impact.
On the other hand, they probably confessed their error in record time. There can be no claims of downplaying or sweeping things under the rug that usually accompany reports of a data breech.
...struck again >>
Religous speak to God. Insane are spoken to by God. When all shut up, one can finally hear Shostakovich in peace
must be great to never make mistakes
I found it on pastebin, it wasn't hard, just search in the last 24 hours. My email address wasn't there either despite getting the apology email.
Comment removed based on user account deletion
"Mistakes will happen", "I thought they handled the screw-up exceptionally well",
"They've put their money where their mouth is", "they deserve credit for that",
"The impacts of this on the Reg readers affected is probably fairly minimal".
Anybody else did this and the reactions would be much different. I figure the Register
has called in everybody they can for damage control.
I've read the Register for while when they were hacked and down for a full weekend
just recently, I went to the site Monday and not one word about it was posted.
Disposable addresses - do support www.bugmenot.com by adding a name and password when you can.
Well, the pastebin links to http://theregisteremailleak.webs.com/theregister.txt
If you scroll right to the bottom you find...
Just kidding! This list is made up for fun! :)
Someone having fun trolling?
The Register has investigative reporters and aggressive editors. If they were able to diagnose the problems in other companies data systems, how come they were so blind to what was happening in their own organisation.
And how crass not to accept blame as an organisation, but to put the blame on an individual employee. They would ridicule any other company that tried to deflect blame this way.