Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Marketing Firm Exactis Leaked a Personal Info Database with 340M Records

wired.com

Post reply on HN
Print view View original

221–230 of 307 posts

Re: Marketing Firm Exactis Leaked a Personal Info Database with 340M Records

#221

Post by Rjevski »

macintux wrote: post #219
Rjevski wrote: post #205

Earlier quoted context omitted.

I hope they were not and this data ends up public. I’d love to search this database for the details of top people at privacy-violating companies and publish them.

> I’d love to search this database for the details of top people at privacy-violating companies and publish them. Who defines "privacy-violating"? Jumping into the mud because you feel aggrieved just makes you look like a pig.

Facebook? Equifax? Ad networks?

Basically anyone who profits off user data and makes it difficult/impossible to opt-out.

Re: Marketing Firm Exactis Leaked a Personal Info Database with 340M Records

#222

Post by INTPenis »

mtremsal wrote: post #214
achillean wrote: post #127

There is currently 904.8 TB of data available on Internet-exposed Elastic clusters. Here is an overview of where these servers are located: https://www.shodan.io/report/yhaN9gje

2.6MB per person on average? That's a lot of personal data...

An exposed elasticsearch server does not equal personal data though. It can be used for anything really. I have two systems that use ES and none of them for personal data.

Re: Marketing Firm Exactis Leaked a Personal Info Database with 340M Records

#223

Post by mtgx »

AndyMcConachie wrote: post #206

It's interesting that we consider this a leak only when the marketing firm loses the data. If we lived in a just society we would consider it a leak once the marketing firm got the data.

I've been a proponent of this idea:

Make companies "super-liable" for any data beyond the data they (actually) need for the functioning of the service that is stolen in a data breach from their servers.

This would hopefully not just encourage more companies to believe that data is "toxic" [1] and treat it as a liability, not as an asset, but it would also encourage them to adopt end-to-end encryption in as many types of services as possible (and eventually stuff like homomorphic encryption or any form of encryption that doesn't give the company itself and hackers direct access to the data).

[1] - https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...

Re: Marketing Firm Exactis Leaked a Personal Info Database with 340M Records

#225

Post by cmpb »

JoeAltmaier wrote: post #208
AndyMcConachie wrote: post #206

It's interesting that we consider this a leak only when the marketing firm loses the data. If we lived in a just society we would consider it a leak once the marketing firm got the data.

And what really changed? They used to sell the data, right? Now everybody has it (instead of only a percent). Is that worse?

This is pretty much where I’m at as well, on this issue. I only wish there were social security numbers contained in the breach so that we could stop considering them as personally identifiable info.

Re: Marketing Firm Exactis Leaked a Personal Info Database with 340M Records

#226

Post by mysterypie »

Oh, man, another missed opportunity to make the average Joe Six-Pack become aware of data aggregation and privacy violations. If the researcher had downloaded the 2TB of data and published it as a torrent, then laymen might care. When someone can query the list and see his own personal information being broadcast, they will understand. When they realize that anyone can look up the address, phone, and all sorts of other info about their wife, husband, girlfriend, boyfriend, boss, children, or neighbor, they might get an inkling that privacy isn't such a stupid thing to worry about.

I realize that we all suffer if it gets made into a torrent, but sometimes pain is necessary to get action.

Within a week, this whole thing will be forgotten and nothing will have changed because privacy is too abstract for most people -- they need to see the personal information that's being collected. The researcher acted properly, but going full Snowden would have had much greater impact on getting better privacy-preserving laws and technology.

Re: Marketing Firm Exactis Leaked a Personal Info Database with 340M Records

#227

Post by AdmiralAsshat »

craftyguy wrote: post #16
axaxs wrote: post #14

When will this stop? When's the last straw? If I gave a bank 100 dollars, and they lost it, I'd have avenues with which to pursue some sort of justice. If I give a company my data, and they lose it, oh well. I wish all personal data was treated like HIPAA, at a minimum.

> When will this stop? When's the last straw? When the top folks in the US government are personally affected. Until then, "congressional hearings" and presidential ambivalence is the most action we'll get out of them. Most people don't really understand what the significance of these events are.

Since some percentage of Congressmen and Senators were almost certainly part of the breach, all we need to do is search for them once the data becomes available and post hand-curated lists of Senator McConnell's Shopping Habits.

Remember, we only got the Video Privacy Protection Act after someone published Bork's rental history during his supreme court nomination[0]. I had to say that public shaming works, but, public shaming works.

[0]https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act

Re: Marketing Firm Exactis Leaked a Personal Info Database with 340M Records

#228

Post by lotsofpulp »

axaxs wrote: post #35
patrickg_zill wrote: post #31

Earlier quoted context omitted.

The credit card info is called "level 3 data" and they in some cases have line item by line item detail. Not just "spend $24.89 at Meijer store #349" but each individual thing, e.g. you bought 2 avocados.

Is that recent? I just started getting it this year. Is there a way to opt out?

I noticed that now when my employees buy from staples.com, my AmEx statement will show everything they bought. From a manager's perspective, it's kind of awesome because you don't need to keep track of little receipts.

Re: Marketing Firm Exactis Leaked a Personal Info Database with 340M Records

#229

Post by mygo »

hopeless wrote: post #160

A lot of people complained that GDPR was too onerous on small firms and that they should be exempt. According to LinkedIn https://ie.linkedin.com/company/exactis-llc Exactis has just 10 employees (obviously some error possible. Call it 15-20?) Now do you think small firms can’t hold large quantities of damaging data?

I think the root of the argument about small firms was not about employee count, but that small firms typically do not have the resources to comply. But what is Exactis’ annual profit? Maybe they did have the financial resources.

Re: Marketing Firm Exactis Leaked a Personal Info Database with 340M Records

#230

Post by justwalt »

jonhendry18 wrote: post #15
chatman wrote: post #8

And, they made fun of RMS... He was telling you what the future holds. This is just a trailer of what is to come.

Information wants to be free. That includes information you don't want to be free.

Where do I sign?
Post reply on HN