THREE MILLION Moonpig accounts exposed by flaw Custom mugs and tat outfit Moonpig has a signficant flaw that exposes personal records and partial credit card details for some three million customers, almost 18 months after it was reported. The failure, discovered and privately reported by developer Paul Price, meant every account and the names, birth dates, and email and …
Wow. This is really the time when a reassuring notice on your web site is good PR move.
Even if you don't admit liability, it's good practice to at least acknowledge that there's been a problem and offer some reassurance that you're fixing it.
Or, like Moonpig, you can just pretend that it never happened....
*any* company processing customer orders over the phone / internet should be forced to have a security audit once a year.
To this end, a list of companies passing / failing this test could be published and we, the great unwashed public, can then vote with our wallets as to whom we trust our identities with.....
Any organisation dealing with credit cards has to be PCI compliant.
Or rather, every organisation that deals with credit cards IS PCI compliant right up until they realise that someone else now has your CC number. It's a nice idea but I've never seen an audit that actually looked in close enough to spot every single possible security hole, and it only takes one.
This was a pretty stupid one though, and taking over a year to fix it is terrible.
There is a notice posted. Not on the front page, but on the Contact Us page at https://photobox-mpusa.custhelp.com/app/ask.
One might also say "It was on display in the bottom of a locked filing cabinet, stuck in a disused lavatory with a sign on the door saying “Beware of the Leopard”
@Elmer Phud - "Depends on whether you go the whole hog and give them all your details or not.
(similar to people moaning about FB when they have added thier entire life story to personal info.)"
No. It's not like moaning about Facebook at all. Facebook is a social networking site, Moonpig is an online shop that mostly sells greetings cards, often sending them directly to the intended card recipient. Moonpig should (and is required by law) to take responsible care of personal, including payment, details. If you don't want them to have any of your, or your intended card recipient's details then you're not going to be able to do any business with them in the first place.
Try getting Amazon to deliver to you if you don't give them your money or your address.
"Depends on whether you go the whole hog and give them all your details or not.
(similar to people moaning about FB when they have added thier entire life story to personal info.)"
You are right, it does depend on whether you go the whole hog and give them all your details or not. Like facebook (it is possible to give Facebook enough information for your friends to identify you without giving them any real personal stuff). One major difference. See how far you get with Moonpig without entering at least a credit/debit card and address.. With Facebook you don't have to produce either.
Why complain? It's all in our name.
Our business model is to drop our trousers and display our naked arse to the entire internet...
[cue: music] Moon Pig dot com
Our policy to ignore everything and stick our fingers in our ears going oink oink oink la la la is just a bit of extra bare-arsed cheek.
I'm not sure why he's making such a big thing about the API help documentation, It's fairly standard practice to make that info publicly available. Maybe he doesn't have much experience of working with APIs?
That doesn't in any way excuse the lack of OAuth, or the inclusion of the customerID in the URL though, they should be roasted for that...
Just asked them to close my account - the URL for the customer service form is https://photobox-mp.custhelp.com/app/ask
When I noticed Photobox in the URL, I checked, and found it's the same company (also paperShaker and Sticky9, who I've not heard of). Just to be on the safe side, I closed my account there as well. At least you can do that online in real time.
I've been a customer of moonpig (apparently) for 15 years, and photobox for at least 8. Their print quality was far superior to tesco as well, but I guess that will have to do now.
I haven't looking into photobox app, or whether there is a similar API problem there, so I can't really comment. You can close your photobox account without having to contact customer services though, so the platform is obviously not completely identical.
I simply closed that account because the company is clearly insufficiently motivated to protect my privacy,
"....We are aware of the claims made this morning regarding the security of customer data within our Apps. We can assure our customers that all password and payment information is and has always been safe. The security of your shopping experience at Moonpig is extremely important to us and we are investigating the detail behind today’s report as a priority. As a precaution, our Apps will be unavailable for a time whilst we conduct these investigations and we will work to resume a normal service as soon as possible. The desktop and mobile websites are unaffected..."
This post has been deleted by its author
> all password and payment information is and has always been safe
Technically correct: passwords aren't exposed, and you don't get full credit card information.
However, they're being extremely dishonest by not mentioning all the other crap (ordering on others' accounts, seeing all their addresses, etc, etc).
proof that you can sell a computer and a printer to a fuckwit and they will merely use it to connect to someone else's computer and printer.
My daughters school were in the process of designing xmas cards to sent to someone else for printing and sending and taking a huge cut when I pointed out they had everything they needed to do it themselves and it would be a good excercise as part of business studies.
Moonpig have replied to my request for information as follows:
"You may have seen reports this morning about our Apps and the security of customer details when shopping with Moonpig. We can assure our customers that all password and payment information is and has always been safe. The security of your shopping experience at Moonpig is extremely important to us and we are investigating the detail behind today’s report as a priority. As a precaution, our Apps will be unavailable for a time whilst we conduct these investigations and we will work to resume a normal service as soon as possible. The desktop and mobile websites are unaffected.."
The last thing I want to see over any form of public or other occasion are the mewing brattish faces of someone or their wife/husband/offspring/dog/cat/house/car etc that I either don't like or don't remember plastered on a last minute greetings card from this bunch of cowboys, or that other bunch of fuckwits Funky fucking pigeon (that I assume are either part of the same company or equally as shit when it comes to security).
/end_rant
Well basically I emailed them the following:
"Please close my account with the email address provided. You're not a safe company to deal with, especially as you were told about this issue 18 months ago. If you're looking at it now why couldn't you do it 18 months ago? Oh yeah, that's right: it'll cost money.
Delete all my information from your account please."
The response:
"Thank you for taking the time to contact us here at Moonpig.
We are sorry to hear that you would like us to close your account and understand your concerns. We have now carried out your request.
We would like to assure you that all password and payment information is and has always been safe. The security of your shopping experience at Moonpig is extremely important to us and we are investigating the detail behind today’s report as a priority.
As a precaution, our Apps will be unavailable for a time whilst we conduct these investigations and we will work to resume a normal service as soon as possible. The desktop and mobile websites are unaffected.
If at any point you wish to reopen your account just let us know and we will be very happy to welcome you back.
Kind regards,
Nicholas"
How can they reopen my account if it's been deleted?
Here is the response.
I sent back:
"How can you reopen my account if I've asked you to delete it? If it's deleted it shouldn't be recoverable?
Please, delete my data. All of it. Properly. "
They said:
"Thank you for taking the time to get back in contact.
We have now requested that all personal details relating to your account be removed. Please bear in mind that you will no longer have access to your order history. Should you wish to re-open an account in the future you would be able to use the same email address but lose access to any previous orders.
If you require any more assistance or information please feel free to contact us further and we will be more than happy to assist."
I didn't CC the ICO in it, should have done. But I don't feel totally confident that they will do what they said to be honest.
I "deleted" my account with them, and specifically asked for deletion, not just flagging as deleted or dormant, and got a confirmation email from them that it has been done. Great!
Guess what - I CAN STILL LOG ON, and see my order history, contact addresses, reminders etc.
Omnishambles!
This post has been deleted by its author
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
