topic Re: Avoidance of the leaked email addresses issue in Plusnet Feedback

Avoidance of the leaked email addresses issue

LordFox — Wed, 11 Mar 2015 02:12:53 GMT

This is a feedback issue regarding Plusnet, not a query about email problems.
Plusnet, you have in some way allowed unique email addresses of many of your customers to be leaked to a spmmer. This is practically irrefutable; there is far too much evidence that the leaked data can only have come from you.
Now, my private email account that I have paid for for almost as long as the Internet has been here, and which has NEVER had spam to the base domain address, is receiving the same, easily identifyable spam we have been receiving to our unique addresses known only to you. This means that the spammer is now moving further than just using the exact email addresses that were compromised, and it is only a mater of time until such things as dictionary attacks begin and render my email account unusable.
The amount of work I will have to do to contact everyone who has my contact details on that domain will take me many days to do, and I doubt I will even get to most of them.
You, Plusnet, had been far too silent on this issue and tried to brush it under the carpet.
You have allowed our data to get into the hands of spammers, and this is going to cost at least me, and I guess many others, a lot of time and money to correct.
What are you going to do about this?

Re: Avoidance of the leaked email addresses issue

Townman — Thu, 12 Mar 2015 20:18:43 GMT

Frustrating as this is, the horse has left the stable. There is no practical thing which PlusNet can now do. The milk is out of the bottle. The best that can be done is to ensure no more milk can be spilt.
Personally I would like to hear that PlusNet will stop using all third parties for service delivery which involves the release of personal data, including email addresses. PlusNet are not alone in this respect - far too many organisations farm out their email marketing activity rather than keeping such activities in house. Running in-house marketing email services is not that difficult - I do not understand why such activities are farmed out... especially with the marked risk of third party data leakage.

Re: Avoidance of the leaked email addresses issue

Empirical — Thu, 12 Mar 2015 20:30:23 GMT

So whats all this about, what emails have been leaked? The ones provided by plusnet or the ones supplied as registered?

Re: Avoidance of the leaked email addresses issue

LordFox — Fri, 13 Mar 2015 15:37:33 GMT

The continued silence from PN is deafening ...and the spam floodgates are opened here, just as I feared! It seems even Amazon Prime isn't above joining the various services the spam is trying to sell.
There is far more PN can do - it can come clean, admit to its userbase as a whole there has been a problem (whether or not PN claims it cannot find out how it happened) and offer compensation to those of us who have been severely inconvenienced and will be put to expense because of this leak.
@Empirical, thank you for the question. It shows exactly how this issue has been kept quiet by PN by keeping the thread away from feedback and in the email problems section, where people wouldn't go unless they had, well, an email problem I guess.
It certainly shows that they have not done as was suggested and requested by us, asking their userbase as a whole if they were receiving the particular spam. It would have helped them greatly in determining where the leak was to know how widespread it was. That assumes they don't already know, of course, and that the supposed investigation PN did was actually an investigation and not a cover up.
The spam (which is unusual in format and easily recognisable from others) is going to unique addresses that many of us have made up entirely for PN's billing system, and are used nowehere else. It is not PN-supplied addresses, but our own, private addresses that we gave to PN that have been leaked.
We are all similar in this. My own address is one that has never, ever been given to anyone other than PN, does not even exists on my PC as a sendable address (so no leak from me is possible) and is received only by a catch-all email account that I pay for.
The whole point of doing this, and I have done it for years, is that if I get an email sent to me using a particular address, I know for a fact that it has come from the company I ghave that unique address to. Or, they have given it to someone else.
Have a read through the thread here if you are interested. Even the media got involved at one point - they might again if things don't improve on PN's side soon.
http://community.plus.net/forum/index.php/topic,133959.0.html

Re: Avoidance of the leaked email addresses issue

LordFox — Fri, 13 Mar 2015 16:15:29 GMT

Well, I had a spare ten minutes between cleaning out the spam, so I used PN's online chat and asked how PN plans to compensate me for the this.
Not surprisingly, it was a complete waste of ten minutes.
The agent I spoke with claims they know nothing about this issue (utter rubbish), denied that there could have been any leak of information (even PN has not said that, in case it gets caught out) and suggested I raise a ticket. Which, of course, I had already done and got nowhere.
You are leaving my with little alternative here PN, I won't let this matter just go away and foot the bills and wasted time myself.
I have used this email system, for about twenty years, and in all that time had hardly any spam to it because of the system I implemented. Now, I am receving more spam than genuine emails, thanks to PN.
"Good honest bradband from Yorkshire" - yeah, right!

Re: Avoidance of the leaked email addresses issue

Townman — Fri, 13 Mar 2015 17:24:28 GMT

I really do not understand what you want to happen. There is nothing NOW that PlusNet can do to stem the SPAM which seems to be your present complaint...

Quote from: LordFox
You are leaving my with little alternative here PN, I won't let this matter just go away and foot the bills and wasted time myself.

What bills and what waste of time? Seems that all you want is a fight.
I do understand your frustration, but surely the simple solution is to replace the existing unique email address you have for PlusNet and "blackhole" the old one. Five minutes work and the problem is gone - no bills (?) and no more wasted time.

Do not get me wrong, I am not defending PlusNet for what has happened, but it has happened and cannot be undone. There is nothing PlusNet can do over the consequential flood of SPAM - that is for you to manage, in the same way we had to after the 2007 webmail server hack which stole numerous email addresses used with webmail.
Assign new email addresses, blackhole the old ones, move on and enjoy life. The people I really feel for are those who have given every contact the same email address. They do not have the means that you have to manage the problem.

Re: Avoidance of the leaked email addresses issue

LordFox — Fri, 13 Mar 2015 20:58:15 GMT

Townman, what you fail to understand is that the domain I use is now being attacked at the base level with this spam.
It is pointless to blackhole the original address (it is already filtered off so I can keep a record of the spam).
An address I have used, as my main means of communication (I have autism) for twenty years, and which I have kept almost free of spam, is now receiving quantities of spam to the base address. I repeat, not just the address given to PN but now to the address I receive as the catch-all address.
The spam is exactly the same as that also sent (duplicated in fact) to the PN address - it is from the same source and thus is of the same cause.
I have never used an antispam service due to the chance of losing legitimate emails, which happened the only time I tried such a service out. I have never needed such a service before, however now, thanks to PN, my account is receiving more than double the amount of spam I have seen in all the twenty years that I have used the addresses.
Everyone I have communicated with in all that time has a unique email address on my system.
Do you have any idea of the length of time it will take to try to contact all of them, generate new addresses on a new domain (since this one is likely to succumb to spam sooner or later now) and the cost of my time to do so? And the cost of finding another such servivce; I do not think even Clara offer it any more and keep mine active only as a customer service.
Why do you take it on yourself to say there is nothing that PN can do? There is a lot they can do, but they won't unless they are made to, it seems. People jumping in and saying there is nothing more they can do can only hurt those of us who say they should. Why do that?
I certainly do not want a fight; with autism, I find I am really quite poorly equipped to deal with such matters. I refuse to allow that to stop me trying to get what is only right though and have found means to do so before.
If you do not feel that it is a problem to you, please do not apply whatever reasoning brings you to that conclusion to me. We are clearly not in the same situaton.

Re: Avoidance of the leaked email addresses issue

Townman — Fri, 13 Mar 2015 21:58:00 GMT

I think you are totally missing the point and using your autism as a reason to want the world to revolve around you. Your expectations need reappraising so as to lower your stress levels. If your email addresses / domain name is out in the wild receiving spam, there is nothing which can now be done to rectify that. The "target" addresses are out there, they will be used, NOTHING can be done to rectify that. You need some other strategy - both technically and personal coping strategy.
What relationship is there between the PlusNet email address used for billing and the the "base address"? Do you mean that you used plusnet@yourdomain.co.uk as your PlusNet billing address AND another-address@yourdomain.co.uk is now receiving spam too?
Is this a catch all email box?
Did you by chance click the UNSUBSCRIBE link on an earlier email?
Is this spam to the "base address" all to a single "name" or multiple "names"?
If none of your specific names are receiving spam then you only need to sort out the catchall mailbox.

If this does not help you, then please do spell out in simple words what you believe ought to be done by PlusNet to fix your CURRENT issue - may be you know more about how email works than do the members of this forum - you might have something to teach us.

Re: Avoidance of the leaked email addresses issue

LordFox — Fri, 13 Mar 2015 23:12:02 GMT

I think you are now being personal and offensive in you opposition to me. Why? Until now I have not even mentioned that I have autism in many years (of admittedly low activity) on the forum. I mentioned it because otherwise my comment regarding email being my main mothod of communication and the importance of that email address would not be understood as clearly.
I have used my autism as an excuse for nothing - do not put your misinterpretations on me. As to wanting the world to revolve around me - I want compensation for a comapny losing control of my personal information, in breech most likely of the data protection act, and the problems it is now causing me. How is that "wanting the world to revolve around me"?
Please leave such personal, and incorrect, assumptions about me out of this; they are not relevent nor welcome.
Have you read the post I made in the main thread on this matter?
I use an address in the form plusnet12345@myaccountname.clara.co.uk. That is what was leaked and originally was the only address receiving the spam.
Duplicates of the spam are now being sent addressed directly to the catch-all address, myaccountname@clara.co.uk. This is what has changed, as I have now repeated several times. That catch-all address has never, ever been used except twice a year by Clara themselves for billing purposes.
Do you understand now?

Re: Avoidance of the leaked email addresses issue

spraxyt — Fri, 13 Mar 2015 23:52:56 GMT

I suspect the reason the base address is now receiving spam is because spammers will understand the mechanisms behind many email mailbox name rewriting processes - Claranet are not the only ones who use that system.

Re: Avoidance of the leaked email addresses issue

LordFox — Sat, 14 Mar 2015 00:28:25 GMT

spraxyt, yes, I agree.
It means someone is actually leverging the information in the database they have rather than simply using a list. It raises the issue that they will likely make more attacks now, based on the original address, where previously the spam has been restricted to only the leaked address. The spammers do not know or care that the thousands of addresses they could generate from it will all go to one person.
That is my concern. I can cope with one address being taken out by this; it's not the first time a company has leaked an address I have given them. This is the first time spam has subseqnetly come directly to the base address. If a larger scale bombardment now happens against my account, it will cause problems.
It is still an "if" of course, unfortunately so far, the "ifs" have happened.

Re: Avoidance of the leaked email addresses issue

hex — Sat, 14 Mar 2015 00:47:54 GMT

Is the base email address explicitly being used though? Some spam will bcc email addresses so you cannot see who they are addressed to so may still be getting sent to the original 'leaked' email even if it is caught in your catch-all mailbox.

Re: Avoidance of the leaked email addresses issue

LordFox — Sat, 14 Mar 2015 03:13:05 GMT

Duplicates of each spam email are now being sent addressed directly (from X-Original-Recipient) to both the leaked address (plusnet12345 @myaccountname.clara.co.uk) and the base address simultaneously. Also, each copy has the relevent destination email address in the subject, as is the way with this spam. Except that the one to the base account is actually not the domain I use I've just realised...
Interestingly (maybe) is that the ones going to the base address are addressed to myaccountname @claranet.com - I do not use that domain, I use myaccountname @clara.co.uk. Higher up of course is envelope-to myaccountname @clara.co.uk since that is what I receive as the catch-all address.
So they haven't just sent (or BCC'd) to the base address they would get from the leaked address (clara.co.uk). Not sure how they have come up with claranet.com. It does work, but originally it was clara.co.uk and that is what I've always used. I can get nslookups to give my mail server IP addresses followed by looking up the domain names to give me clara.net, but not claranet.com. Huh!
I don't claim to know much about reading email headers unfortunately (depsite certain patronizing remarks somewhere above).
What I do know is that this is the very same spam, from the very same source that was provided with our data from PN, now sending me duplicates to the (or at least one) base address.

Re: Avoidance of the leaked email addresses issue

gswindale — Sat, 14 Mar 2015 13:41:17 GMT

I'm slightly puzzled by this.
Firstly as I've taken a quick look through the email sub-forum and nothing leapt out at me about a leak. Maybe a link to the specific thread would be useful here?
Secondly; I'm still getting very little spam on the account that PN use for billing notifications etc.

Re: Avoidance of the leaked email addresses issue

Townman — Sat, 14 Mar 2015 13:42:50 GMT

See post #3

Re: Avoidance of the leaked email addresses issue

hex — Sat, 14 Mar 2015 16:29:09 GMT

Quote from: LordFox
Interestingly (maybe) is that the ones going to the base address are addressed to myaccountname @claranet.com - I do not use that domain, I use myaccountname @clara.co.uk. Higher up of course is envelope-to myaccountname @clara.co.uk since that is what I receive as the catch-all address.

Have you considered the possibility that in your case this leak was via claranet somehow rather than plusnet - do you use that account to set up the aliases or for the mailbox rather than your own server?
It may be that the incoming mail server is rewriting the address but I assume it is not doing that to your other emails? It is however a bit suspicious if the spam is only coming in address to the 'plusnet' email if you have other aliases on the same account (and the fact others have reported spam to their email addresses).

Re: Avoidance of the leaked email addresses issue

LordFox — Sat, 14 Mar 2015 20:10:31 GMT

You mean, that clara has just now leaked my address to exactly the same spammer (since the spam is of an easily recognisable format) as PN did with the address I gave to them?
No.
We have gone around and around this issue in the original thread, with people coming up with plausible-sounding but easily refuted excuses other than PN.
Bottom line - the only common factor in all of it for all of us is PN. There is no other reasonable explanation.
Please, read the thread if you are interested. You'll see what I mean, and how poorly the matter has been handled by PN given that they have clearly lost control in some way of our personal data.
Even PN cannot (and have not) denied that they are the source of the data, despite all of the "well, it might be..." which have been shot down in flames by the simple facts every time.

Re: Avoidance of the leaked email addresses issue

LordFox — Sat, 14 Mar 2015 20:18:31 GMT

The prevailing theory from some customers is that the data was lost at some third party whom PN gave it to for some reason, like everyone seems to outsource these days.
I don't necessarily buy into that, it's just one possibility. Probably the most likely one, but PN certainly aren't for telling us anything.
This is PN's final response to the matter:
http://community.plus.net/forum/index.php/topic,133959.msg1182640.html#msg1182640
...with which there are a number of issues, including their insistance that it is only a small number of users effected, i.e. those of us who have generated unique email addresses for the purpose of detecting where spam comes from, and have therefore noticed and complained about it. Has PN asked anyone who hasn't complained to check their spam traps? Nope! So that comment of PN's is meaningless and misleading.

Re: Avoidance of the leaked email addresses issue

gswindale — Sun, 15 Mar 2015 13:28:36 GMT

But,
I have had nothing end up in my junk mail folder that I don't know where it came from - thereby making your assertion that PN's comment is meaningless in itself incorrect.
All of my junk email that I get on my billing email address seems to mainly be late rooms or estate agents (all of whom I signed up with). The rest is occasional emails that I had been expecting but got classified incorrectly.
Maybe my email provider's server is better at fleeing out real spam; but I certainly don't seem to have a problem with stuff going AWOL.

Re: Avoidance of the leaked email addresses issue

Phileasfrog — Sun, 15 Mar 2015 16:12:40 GMT

In my opinion (for what it is worth!), this new thread has turned out to be rather a waste of time. There seems to be a tendency among some posters to question what has been "conclusively" shown in the original thread - ie that a clear and obvious leak has occured and that it is Plusnet where the blame lies. I was one of the many users who received spam to a distinct email address which Plusnet has on their records, although it did refer to a period of about 12 months or so ago. Thankfully this spam stopped in Nov last year..
The point to observe at this stage is that Plusnet seems to be unable to accept the fact, or that they are waiting for the results of various official complaints before commenting further. I do strongly suggest that the original thread be closely studied before trying to re-invent the wheel!