Play.com spam points to malware downloads Multiple Reg readers were annoyed at receiving junk mail messages on Monday from addresses they had only registered with online retailer Play.com. Several of these junk mail sites pointed to black hat controlled domains that served up malware, heightening complaints on online forums (discussion on MoneySavingExpert here) and …
That uses a different address for each website - very useful for seeing who your spam comes from, but more useful for seeing the attitude of the company when you tell them "wasn't our fault, you must be mistaken", and the tech ability of the staff when you have to actually speak to them...
"Are you SURE your email address is sky@*****.co.uk".
Another Nerd(ette?) here, I use the same system, it doesn't cost much to buy your own domain, then you can use unique addresses for each website. I do this, and once its breached, change the address and you can force the old one to bounce, you also know which site has had its security breached (or sell your details Without your consent) and you can then make a choice whether to continue using that site since they don't seem to take security (or your privacy) seriously. Words (and excuses) mean nothing, actions speak louder, if they're selling your email addresses, what else are they doing, ie do you store your card details with them? Food for thought.
This post has been deleted by its author
I received this lame apology from Play too. Really annoyed, because I'd kept my address 'clean' for years and now through no fault of my own it's going to get a ton of spam and I need to change passwords etc.
Interesting that you mention the GSN link because I got spam yesterday purporting to be *from* GSN (offering Acrobat X PDF Reader). I've never been to GSN.com in my life let alone signed up.
I haven't bought anything from Play in a couple of years now, but certainly won't be again after this!
I got one from GSN as well. I've never been there so emails from them are now blocked. At least now I know why. I have bought from Play, but never again. If you value your customers privacy and their details why outsource to another company? Well? Care to answer that one Play? Obviously profit comes before privacy. I shall be telling play to delete my acount forthwith. Yes, I use different addresses for different sites as well, so another nerd here and proud of it:-)
Paris. Well why not:-)
Dear Customer,
Email Security Message
We are emailing all our customers to let you know that a company that handles part of our marketing communications has had a security breach. Unfortunately this has meant that some customer names and email addresses may have been compromised.
We take privacy and security very seriously and ensure all sensitive customer data is protected. Please be assured this issue has occurred outside of Play.com and no other personal customer information has been involved.
Please be assured we have taken every step to ensure this doesn’t happen again and accept our apologies for any inconvenience this may have caused some of you.
Customer Advice
Please do be vigilant with your email and personal information when using the internet. At Play.com we will never ask you for information such as passwords, bank account details or credit card numbers. If you receive anything suspicious in your email, please do not click on any links and forward the email on to privacy@play.com for us to investigate.
Thank you for continuing to shop at Play.com and we look forward to serving you in the future.
Play.com Customer Service Team
Presumably as part of "being vigilant" with my personal information, I should avoid doing any business with a company that manages to hand it over to a third party who promptly gets it nicked.
While I'm sure that's just their standard boilerplate privacy crap, they probably should have thought about leaving out the instructions to be careful with our personal information when sending out an email telling us they've just lost our personal information.
Several copies of the spam seen here, one to an account that is specific to Play, and one used with Play but which isn't on their newsletter/marketing lists.
Either it's more widespread than just Play, or as I suspect it's not just limited to their marketing lists.
After 11 years, looks like it might be time to close my Play account.
I use throwaways for each registration but don't actually read anything coming from Play.com
Looking at my deleted emails in gmail from Play, I see no apology but my gmail decided the email from GSN was spam.
I assume Play.com hashing the stored passwords with something decent and don't share that with GSN? There's no need to share that field of a database.........
If the security breach is restricted to a third party company, then we should expect many more clients of that company to be affected. It's possible that GSN is not directly related. If/when we start seeing a large number of companies affected, all using the same marketing company, then we can let Play.com off the hook a little, but only a little.
Retail companies have to remember that the buck stops with them, legally and morally, and also financially when customers vote with their feet. Outsourcing must never be out of sight and out of mind and a way to blame someone else.
I've found that even large companies like Sainsbury's can lose control to marketing companies, so that customers effectively lose the ability to opt out and have to rely on filtering.
I also give everyone their own address. What I've noticed is that it's usually the smaller retailers that go bad. But it isn't always my Avast address when bad a while back but I didn't get anywhere trying to explain it on their forums:
http://forum.avast.com/index.php?topic=49786.0
Admittedly I could perhaps have used a less contentious subject title but it was sad that no-one could see what I was getting at. Interestingly a quick look at my server logs show that I don't get spam for that address any more. Other addresses do still generate spam (including some that are many years older) so my theory now is that it was marketing material and they were able to pull the address.
And I got the GSN Adobe Update email.
I won't be closing my account with play, but I think a strongly worded email demanding no more marketing and no passing of details onto third parties for marketing might be in order.
I don't recall what options there were for marketing when signing up with play (I signed up a long time ago), but I'm always careful to opt out of marketing when signing up to things in general.
"I don't recall what options there were for marketing when signing up with play (I signed up a long time ago), but I'm always careful to opt out of marketing when signing up to things in general."
I've noticed that whether or not the options are given, as often as not they subscribe you to their newsletters anyway: as someone pointed out a few comments back, unfortunately the smaller etailers seem to be worse for doing this sort of thing.
As for Play, I complained to them when I received the GSN email and received an apology of sorts for their apparent marketing gaffe, but nothing to say that the contents were a bit dodgy. Just as well I binned it in the spam folder anyway, I suppose...
I've had a look through their T&Cs and can't find anything about marketing firms. I also can't find anything in my account settings to do with marketing (I'm pretty sure you have to provide an easy way to remove yourself from it if you don't untick the box when you join [something I always do anyway]), so isn't passing my details on to a marketing company kind of, well, illegal?
No sign of any GSN or other junk mail yet but Mrs. Grouse did get the weakly apologetic and pathetically vague e-mail sent to her unique Play.com address.
I can't help but notice the timing of this 'accidental' information leak. We're in a global recession with profits down almost everywhere, at the end of a financial year in which the traditionally bumper Christmas consumer spending spree was a lot lower than many expected. There have been rumours for months that Play have had problems that might result in the closure of PlayUSA. And it's quite possible George Osborne will use the upcoming Budget to change the rules on VAT-free traders operating from the Channel Islands and from outside the EU.
Against this backdrop, a chunk of customer information of great monetary value to the bad guys is unexpectedly purloined from Play.com via an unnamed third party? I don't know about anyone else, but I detect something distinctly piscine wafting from the direction of Jersey and it's not the Beresford Fish Market.
So they say "We take privacy and security very seriously and ensure all sensitive customer data is protected. Please be assured this issue has occurred outside of Play.com", which is a contradiction in itself. If they take security very seriously and ensure data is protected, then they wouldn't be giving it out to third parties in the first place.
Goodbye play.com.
The Jersey ICO has received many complaints about Play.com but they never seem to do anything about them. The best thing to do is to submit a section 11 DPA98 request for Play.com to cease processing your personal data for direct marketing purposes.
www.mindmydata.co.uk
From experience all I can say is the the Jersey ICO does a really good job. Actually does what is required. Makes the UK one look like the bunch of muppets that similar experience tells me that they are. Who else but them can write 3 pages to say "Yes"?
As for Play.com, experience with them tends to suggest that their sales have grown larger than their systems and management can cope with. Wednesday's Budget might ease that problem a little for them.
I'm another one who uses separate email address to track who spam.
grumbletext
play.com
svp
applausestore
guitarherofreesongscompetition
icq (yes, that old!)
cheapsmells (perfume retailer)
prepaymania
telephonepreferenceservice (ironically!)
and bangcd are the ones of the top of my head who have leaked my address and spammed me.
Bangcd in particular are funny. The denied it was them (email was only ever used with them), then they denied the unsubscribe wasn't working (it wasn't) then they said I had been removed from a mailing list I never asked to go on and six months later started spamming me again.
I asked why they had lied and got told "
We have become a victim of Industrial Sabotage using Spam email.
Bang CD did not send, or authorise the sending of, this email.
This mail was sent as a malicious attempt to have Bang CD de-listed due spamming.
We have taken legal advice and are currently issuing proceeding to prevent this happening again."
So these Saboteurs have cleverly copied their newsletter in its entirety including the domain it was sent from .. in an attempt to delist band cd for spamming.
NO BANGCD. *YOU* SPAMMED ME YOU LYING CU*TS.
These are the big names from my blacklist:
T-Mobile, Readers Digest, Maplin, Empire Direct, ShopAcer, Pixmania, Friends Reunited, Avast, MBNA, Ovi Marketing
Plus a dozen more mostly small business. Ironically no personal addresses at all.
The Reader's Digest address went bad last week despite the fact I hadn't had any business with them for over four years. It's vaguely interesting checking my server logs out. One of the most requent 'sources' is an address that's been blacklisted for nearly seven years. That disproves the idea that not replying will cause the spam to stop. I guess when I'm long dead and buried at least some trace of me will remain in the interwebs :)
BangCd also have something similar.
BCD News [bcdnewsletter@bangcd.com]
When i email them, they replied that someone is sending out their emails to discredit them/get them on a banned list.
I receivea a couple a day.
Since they replied to my email quickly, I'm not going to cry over a few emails, espeically when they are aware of the problem and trying to go something about it.
Funnily enough, I had cause to set up two Play.com accounts recently and I unsubscribed from marketing emails in only one of the accounts. I received an apology email to the subscribed account, but not to the unsubscribed one, so perhaps there is some logic to their mailings...
Play.com hold two unique e-mail addresses of mine (due to technical glitch creating the first account) and I've seen this happen last year (Mon 13/12/2010 21:21) when I received the spam written up here:
http://www.webologist.co.uk/internet-security/scam-adobe-announces-new-version-upgrades-for-adobe-acrobat-2011
It hit both addresses within seconds of each other. G*ts
Since a useless ISP had a security breach years ago where all my email addresses then being used ended up in the hands of junk mailers (though the ISP techs lied through their teeth despite overwhelming evidence, and denied a breach on their systems was possible), most of my main email addresses are already on various spam mail lists(*), so I'm not sure that play.com handing out one of them to someone who managed to let it escape is meaningfully increasing my personal exposure, even though it's a bit disappointing.
*Though either spam filtering these days is awesomely effective, or continual failure to respond (or to have an enthusiastic email client touching any included weblinks) causes the spammers to lose interest over time.
Years ago, I used to get dozens of spam mails every day, but the rate has dropped hugely - though it happened slowly enough to not be that obvious, I think I'm now down to well under one general sales spam per week getting through, and maybe a bank phising mail every month, and that was before most of the recent botnet takedowns.
I'm just curious to know what ESP (email service provider) they usually use...not that they'd be connected to this in any way, just pure idle curiosity...
If anyone has got a recent legit marketing email from play and could do a full header lookup, you'd make me a less curious man.....
This post has been deleted by its author
Long ago I decided to stop dealing with Play.com, probably because of their spammy attitude. No, I remember now, they used to be really good, but then something changed there and they just became another faceless company who clearly didn't give a shit.
It used to be the case that if you ordered an album that was to be released on a Monday, it would arrive the Friday or Saturday before every time. At some point this stopped happening, and in fact deliveries got slow - when I queried it once they just hid behind their T&C. Bollocks to that nonsense. Play ruined themselves, and it became more convenient to just go to a normal shop!
At least with normal shops, they don't need your name and address which will end up inevitably being abused.
At some point play stopped viewing customers as customers, and started dealing with them as if they were consumers. Consumers are a useful device for describing markets. but they are not the same as humans.
The average consumer has one and a bit legs and arms, one and a bit balls, one and a bit boobs, etc.. Consumers do not exist, customers do. And if I feel I am being treated like a number, I stop dealing with the company and never go back.
Long ago I told Play to delete all my personal data and remove all records that I had ever done business with them. They continued to spam, and I thought about grassing them up to the data protection lot, but did not.
But now I find out they have been using 3rd party companies to spam people? I do not do business with companies that share data, but from what I saw on Netcraft's blog the 3rd party also spammed people who had told play not to spam them. Play had shared personal data of those who had specifically said they do not want spam with a spammer.
I am wondering if I can beat some money out of play over this. They have broken the law (I told them to delete my data, and they did not), I would never have allowed them to share any data with any one else, ever, under any circumstances. OK, the email address I have registered with them does not work any more, so I happened to dodge this bullet, but that isn't the point.
Can I just send them a letter of complaint, mentioning "without prejudice", and a fee schedule? And if they do not compensate me I can sue in small claims in accordance with the fee schedule, and presumably get them done criminally by the data protection office too?
Yes, this is the nasty shit that I don't like about the US-style sue culture. But if you can't beat them, join them! Once companies cross that metaphorical line where they change from being something like a person's business persona to a non-human profit animal they just can't be trusted, so I have no qualms about fucking them over: they would do it to me given half a chance!
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
