Play.com - Security breach email

grizzly

Looks like credit card info is safe though;

http://www.guardian.co.uk/technology/2011/mar/22/play-customer-details-leaked

Amalgam

I received this last night. Hopefully it is just emails and names..

Play.com [info@play.com]

Dear Customer,

Email Security Message

We are emailing all our customers to let you know that a company that handles part of our marketing communications has had a security breach. Unfortunately this has meant that some customer names and email addresses may have been compromised.

We take privacy and security very seriously and ensure all sensitive customer data is protected. Please be assured this issue has occurred outside of Play.com and no other personal customer information has been involved.

Please be assured we have taken every step to ensure this doesn’t happen again and accept our apologies for any inconvenience this may have caused some of you.

Customer Advice

Please do be vigilant with your email and personal information when using the internet. At Play.com we will never ask you for information such as passwords, bank account details or credit card numbers. If you receive anything suspicious in your email, please do not click on any links and forward the email on to privacy@play.com for us to investigate.

Thank you for continuing to shop at Play.com and we look forward to serving you in the future.

Play.com Customer Service Team

************************************************************************
Confidentiality: This e-mail and any files transmitted with it are
confidential and intended solely for the use of the individual or entity
to whom they are addressed. If you have received this e-mail in error
please notify the sender immediately and delete this message from your
computer without further action. Any dissemination, distribution or
copying of this message or any files transmitted with it by an
unauthorised recipient is strictly prohibited.
Viruses: This message has been swept for viruses but we cannot guarantee
that this e-mail or its attachments are virus free nor accept
responsibility for any virus inadvertently transmitted herewith.
************************************************************************

rubadub

I got that too, I never liked the way play kept your CC info in your account, I don't think you could view it but if you had somebodies password you could attempt to order stuff.

It shows the importance of having different passwords for different sites, esp. your primary email. If somebody had my gmail account & password they could chance there arm on many sites and select the "forgot password" option, then a new password or current password would be sent to gmail and the hacker now has access to my accounts on these sites.

Amalgam

To be fair to Play.. don't they force users to use fairly complex passwords. One of the few sites that allow upper and lower case, along with extended punctuation.

Max Power1

got this too.

Looks like its only names and email addresses and not passwrds, hopefully!

Amalgam

Follow up email this morning. Clarifies how the marketing branch was compromised. No CC leaks.

Play.com [info@play.com]

Dear Customer,

As a follow up to the email we sent you last night, I would like to give you some further details. On Sunday the 20th of March some customers reported receiving a spam email to email addresses they only use for Play.com. We reacted immediately by informing all our customers of this potential security breach in order for them to take the necessary precautionary steps.

We believe this issue may be related to some irregular activity that was identified in December 2010 at our email service provider, Silverpop. Investigations at the time showed no evidence that any of our customer email addresses had been downloaded. We would like to assure all our customers that the only information communicated to our email service provider was email addresses. Play.com have taken all the necessary steps with Silverpop to ensure a security breach of this nature does not happen again.

We would also like to reassure our customers that all other personal information (i.e. credit cards, addresses, passwords, etc.) are kept in the very secure Play.com environment. Play.com has one of the most stringent internal standards of e-commerce security in the industry. This is audited and tested several times a year by leading internet security companies to ensure this high level of security is maintained. On behalf of Play.com, I would like to once again apologise to our customers for any inconvenience due to a potential increase in spam that may be caused by this issue .

Best regards,

John

John Perkins
CEO
Play.com

************************************************************************
Confidentiality: This e-mail and any files transmitted with it are
confidential and intended solely for the use of the individual or entity
to whom they are addressed. If you have received this e-mail in error
please notify the sender immediately and delete this message from your
computer without further action. Any dissemination, distribution or
copying of this message or any files transmitted with it by an
unauthorised recipient is strictly prohibited.
Viruses: This message has been swept for viruses but we cannot guarantee
that this e-mail or its attachments are virus free nor accept
responsibility for any virus inadvertently transmitted herewith.
************************************************************************

Butch Cassidy

Play.com are rubbish. They take a Euro off of you each time you order something - an authorisation transaction- and you have to wait weeks for it to be refunded. This means that if you have €10 on your card (Vis Debit or O2 Money or 3V) and you want to buy something for €10 you can't because they charge a Euro which comes out of your balance and then when they try charging you the €10 for the item you want to buy you can't.

jor el

This thread is about Play's security breech. Please don't take it off the topic at hand.