Live data from Hacker News

Amazon admits it exposed customer email addresses, but refuses to give details

techcrunch.com

11–20 of 160 posts

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#11
"Besides the brevity, what's giving people pause is they sign the email http://Amazon.com Why cap the "a" and why no https://? Strange"

This one is easy to answer: the customer support people aren't particularly technical. In many ways, Amazon is a weird mashup of a traditional retailer and a tech company.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#12
When I started selling the first gadget I ever made on Amazon I was so excited and was only getting a couple sales a month. If you were one of my customers I looked at your house, judged your grass, found you on LinkedIn and Facebook, Instagram, mortgages, mugshots, everything lol. The sellers also get your full name and address even on fulfilled by Amazon.

If you have been on the net long enough this will creep you out: https://haveibeenpwned.com/

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#14

based on spam email i have received, that i clearly should not have, i believe this was an exposure to marketplace sellers from whom you have bought a product. I am very careful with my email. i’m not just guessing here. i actually reported it to amazon security. (no answer from them of course.)

Great reason to setup wildcard e-mails so you can do something like amazon@yourdomain.com!

I would assume that's how OP knows the leak came from amazon (assuming the address was more obscure than amazon@whatever.com)

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#15
post #12

When I started selling the first gadget I ever made on Amazon I was so excited and was only getting a couple sales a month. If you were one of my customers I looked at your house, judged your grass, found you on LinkedIn and Facebook, Instagram, mortgages, mugshots, everything lol. The sellers also get your full name and address even on fulfilled by Amazon. If you have been on the net long enough this will creep you…

I can also confirm, I can still see names and addresses, but not emails. Honestly any online retailer has to be trusted with this information, and in the fulfillment by Amazon (FBA) case, there are 3rd party sellers that have some unnecessary access to it. I personally don't actually need access to it since I do FBA exclusively.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#16
post #2

This is one of the less appreciated clauses of the GDPR: That companies are required to disclose data breaches within a reasonable time-frame, and users have the right to know about any exposure of their data.

It sounds like they did that but TC wants more. I'm not really sure why HN allows techcrunch stories on the front page. TC is tabloid journalism at its finest.

They did not disclose any of the following as specified by the data breach notification requirements of the GDPR:

The name and contact details of the data protection officer or other contact point where more information can be obtained

The likely consequences of the personal data breach

The measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects

The are also required to submit the following information to EU authorities, but have given no indication that they have done so or are planning to:

The categories and approximate number of data subjects concerned

The categories and approximate number of personal data records concerned

The mail that Amazon sent to affected customers was barebones and contained almost no information.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#17
One comment further down stated that it might have affected marketplace sellers. Amazon doesn't really put the same amount of thought and resources on marketplace than Amazon retail even if they should IMHO.

Regardless, that's AFAIK the first time that ever happened to Amazon. Bad enough if it was third party sellers. A catastrophe if it was Amazon customers. With all the controversy regarding counterfeits in some countries an incident that bears the risk of impacting customer trust is the last thing Amazon needs. Maybe I should have sold my stock 4 months ago... But maybe Q4 will be stellar and stock goes up again in January. I should think about a stop order, just in case Q4 disappoints that year.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#18
Throwaway account.

- Amazon US/CA/DE/UK/ES users registered and reviewed before this year: your Email is probably crawled.

- Amazon users who registered recently: MAYBE you are safe.

- Account before 2015: your Email is basically public.

- Chances that your Email can be acquired: 25~30%.

My guess: Amazon wanted to make a social platform. They reverted the idea after sellers started to spam negative reviewers.

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#19

based on spam email i have received, that i clearly should not have, i believe this was an exposure to marketplace sellers from whom you have bought a product. I am very careful with my email. i’m not just guessing here. i actually reported it to amazon security. (no answer from them of course.)

eBay are particularly careless in that regard. There's no reason that a seller should ever see the customer's actual e-mail address on such a site but I'm up to ebay5@ on my mail server due to direct spam from sellers from whom I bought one item in the past. No, sellers, I did not 'opt in' to your spam just because I bought something. But why does eBay ever give them the address? Oddly I've never had a problem with r…

[deleted]

Re: Amazon admits it exposed customer email addresses, but refuses to give details

#20

based on spam email i have received, that i clearly should not have, i believe this was an exposure to marketplace sellers from whom you have bought a product. I am very careful with my email. i’m not just guessing here. i actually reported it to amazon security. (no answer from them of course.)

Great reason to setup wildcard e-mails so you can do something like amazon@yourdomain.com!

Might not be best idea to use exact word amazon, have gotten this email before -

> use of Amazon trademarked words, images, or reviews which may include variations or misspellings and this is a violation of our Trademark Guidelines

> [...]

> An example of the above violation can be found here: amazon@[mydomain]

Post reply on HN