Amazon admits it exposed customer email addresses, but refuses to give details

Post by AnssiH » Wed, Nov 21, 2018, 6:04 PM UTC

meritt wrote: post #6

jiveturkey wrote: post #4

based on spam email i have received, that i clearly should not have, i believe this was an exposure to marketplace sellers from whom you have bought a product. I am very careful with my email. i’m not just guessing here. i actually reported it to amazon security. (no answer from them of course.)

They intentionally provide this information to marketplace sellers. It's arguably poor design but it's definitely not an unintentional security flaw. Marketplace/FBA sellers have talked about strategies for utilizing customer email address for years [1] [1] https://sellercentral.amazon.com/forums/t/how-to-access-all-...

Post by behringer » Wed, Nov 21, 2018, 6:10 PM UTC

p49k wrote: post #16

behringer wrote: post #3

Earlier quoted context omitted.

It sounds like they did that but TC wants more. I'm not really sure why HN allows techcrunch stories on the front page. TC is tabloid journalism at its finest.

They did not disclose any of the following as specified by the data breach notification requirements of the GDPR: The name and contact details of the data protection officer or other contact point where more information can be obtained The likely consequences of the personal data breach The measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, meas…

Post by ganeshkrishnan » Wed, Nov 21, 2018, 6:17 PM UTC

p49k wrote: post #16

behringer wrote: post #3

Earlier quoted context omitted.

It sounds like they did that but TC wants more. I'm not really sure why HN allows techcrunch stories on the front page. TC is tabloid journalism at its finest.

They did not disclose any of the following as specified by the data breach notification requirements of the GDPR: The name and contact details of the data protection officer or other contact point where more information can be obtained The likely consequences of the personal data breach The measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, meas…

Post by lozenge » Wed, Nov 21, 2018, 6:19 PM UTC

ejo4041 wrote: post #15

edoo wrote: post #12

When I started selling the first gadget I ever made on Amazon I was so excited and was only getting a couple sales a month. If you were one of my customers I looked at your house, judged your grass, found you on LinkedIn and Facebook, Instagram, mortgages, mugshots, everything lol. The sellers also get your full name and address even on fulfilled by Amazon. If you have been on the net long enough this will creep you…

I can also confirm, I can still see names and addresses, but not emails. Honestly any online retailer has to be trusted with this information, and in the fulfillment by Amazon (FBA) case, there are 3rd party sellers that have some unnecessary access to it. I personally don't actually need access to it since I do FBA exclusively.

Post by ProAm » Wed, Nov 21, 2018, 6:21 PM UTC

garysahota93 wrote: post #13

Wasn't there another post on HN of this?