Email about final bill for on account.

Forums › 2degrees › Email about final bill for on account.

richms

8811 posts

Uber Geek

Trusted

Subscriber

Topic # 107762 19-Aug-2012 16:00
Got an email from 2deg about my overdue final bill (finally) Anyway, at the top is a link for Having trouble viewing this email? View it online. When I click that link I get someone elses final bill amount and name and account number etc. Bit of a big damn oops there from 2degrees about customer privacy etc. Edit to remove the hyperlink. Also its not provided over https so yet another fail security wise. Richard rich.ms

1 | 2

4254 posts

Uber Geek

Reply # 674262 19-Aug-2012 16:07
Is it a privacy beach though? I have been emailed other customer receipts before, and never thought this was a privacy breach. I would have just thought it was an error. I guess it depends on what sort of information is disclosed. But someone else name and address, which maybe publicly available anyway in the phone book may not be a privacy breach.

richms

8811 posts

Uber Geek

Trusted

Subscriber

Reply # 674282 19-Aug-2012 16:35
Tell that to ACC ;) Richard rich.ms

aimsy007

134 posts

Master Geek

Reply # 674284 19-Aug-2012 16:38
mattwnz: richms: Got an email from 2deg about my overdue final bill (finally) Anyway, at the top is a link for Having trouble viewing this email? View it online. When I click that link I get someone elses final bill amount and name and account number etc. Bit of a big damn oops there from 2degrees about customer privacy etc. Edit to remove the hyperlink. Also its not provided over https so yet another fail security wise. Is it a privacy beach though? I have been emailed other customer receipts before, and never thought this was a privacy breach. I would have just thought it was an error. I hate private beaches

z2k

195 posts

Master Geek

Trusted

Reply # 674288 19-Aug-2012 16:57
Hi Richms, this is really concerning. If you pm me the URL you got and your phone number I'll investigate and find out how this happened.

freitasm

BDFL
43727 posts

Uber Geek

Administrator

Trusted

Geekzone

Subscriber

Reply # 674308 19-Aug-2012 17:32
mattwnz: Is it a privacy beach though? Yes, it is. Intentional or not, it is. Mauricio Freitas (Geekzone Admin, Devil's Advocate, my blog, technology disclosure, my tweets, Web Performance Optimization) Geekzone Price comparison \| Amazon Kindle order page \| How to get the best out of Geekzone \| New Zealand IT Jobs \| Geekzone News \| Jinglebugs

2DegreesCare

659 posts

Ultimate Geek

Trusted

2degrees

Reply # 674481 20-Aug-2012 11:49
Hi Rich Please PM your # and acct # so we can look into this ASAP. Cheers ^POB

richms

8811 posts

Uber Geek

Trusted

Subscriber

Reply # 674497 20-Aug-2012 12:09
Already PMed to z2k earlier. Not read yet so sending to 2degrees too. Richard rich.ms

richms

8811 posts

Uber Geek

Trusted

Subscriber

Reply # 674747 20-Aug-2012 19:36
....so... what happened? who cocked up to let this multi step failure of privacy happen? Richard rich.ms

z2k

195 posts

Master Geek

Trusted

Reply # 674780 20-Aug-2012 20:23
richms: ....so... what happened? who cocked up to let this multi step failure of privacy happen? POB is checking with the team that looks after these emails, will update when there is more information.

z2k

195 posts

Master Geek

Trusted

Reply # 675897 23-Aug-2012 12:49
Just an update, it looks like it was an issue with the email template used which has now been corrected.

mattwnz

4254 posts

Uber Geek

Reply # 675903 23-Aug-2012 12:56
There was a similar story on fair go last night, where someone was sent someone else details.

NonprayingMantis

3613 posts

Uber Geek

Reply # 675919 23-Aug-2012 13:25
isn't this similar to an issue that 2D had a while back, where customers found somebody else's details filled in when they went to log into the 2Degrees website?

richms

8811 posts

Uber Geek

Trusted

Subscriber

Reply # 676008 23-Aug-2012 16:16
Will that correct that my details are on a non ssl server with no authentication or just that I see someone elses details on the link? Richard rich.ms

minigopher17

191 posts

Master Geek

Reply # 676024 23-Aug-2012 16:46
I've had a "privacy breach" with Pizza Hut one time. I logged in to order myself a pizza and it said "Welcome Hamish". I had somehow logged in as a Hamish and could see his personal details and preferred pick-up store. By the way, my name isn't Hamish. Just saying that all systems out there have issues occasionally.

ChevronX

271 posts

Ultimate Geek

Reply # 676025 23-Aug-2012 16:46
richms: Will that correct that my details are on a non ssl server with no authentication or just that I see someone elses details on the link? The non SSL part might just be routing, I would imagine it is very much protected. "The Atlantis base, brings greetings from the pegasus galaxy, you may cut power to the gate!."- Dr Weir (Rising) New Zealand · http://www.chevronx.com · http://www.incinerate.co.nz

1 | 2