Email about final bill for on account.

Forums › 2degrees (including Slingshot, Orcon, Flip, Stuff Fibre, MyRepublic, 2talk and Vocus) › Email about final bill for on account.

richms

28198 posts

Uber Geek

Trusted

Lifetime subscriber

#107762 19-Aug-2012 16:00

Got an email from 2deg about my overdue final bill (finally)

Anyway, at the top is a link for Having trouble viewing this email? View it online.

When I click that link I get someone elses final bill amount and name and account number etc.

Bit of a big damn oops there from 2degrees about customer privacy etc. Edit to remove the hyperlink. Also its not provided over https so yet another fail security wise.

Richard rich.ms

1 | 2

20173 posts

Uber Geek

#674262 19-Aug-2012 16:07

Is it a privacy beach though? I have been emailed other customer receipts before, and never thought this was a privacy breach. I would have just thought it was an error. I guess it depends on what sort of information is disclosed. But someone else name and address, which maybe publicly available anyway in the phone book may not be a privacy breach.

richms

28198 posts

Uber Geek

Trusted

Lifetime subscriber

#674282 19-Aug-2012 16:35

Tell that to ACC ;)

Richard rich.ms

aimsy007

145 posts

Master Geek

#674284 19-Aug-2012 16:38

mattwnz:
richms: Got an email from 2deg about my overdue final bill (finally)

Anyway, at the top is a link for Having trouble viewing this email? View it online.

When I click that link I get someone elses final bill amount and name and account number etc.

Bit of a big damn oops there from 2degrees about customer privacy etc. Edit to remove the hyperlink. Also its not provided over https so yet another fail security wise.

Is it a privacy beach though? I have been emailed other customer receipts before, and never thought this was a privacy breach. I would have just thought it was an error.

I hate private beaches

z2k

320 posts

Ultimate Geek

Trusted

#674288 19-Aug-2012 16:57

Hi Richms, this is really concerning. If you pm me the URL you got and your phone number I'll investigate and find out how this happened.

freitasm

BDFL - Memuneh
79314 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#674308 19-Aug-2012 17:32

mattwnz: Is it a privacy beach though?

Yes, it is. Intentional or not, it is.

2degreesCare

1537 posts

Uber Geek

Trusted

2degrees

#674481 20-Aug-2012 11:49

Hi Rich

Please PM your # and acct # so we can look into this ASAP.

Cheers
^POB

richms

28198 posts

Uber Geek

Trusted

Lifetime subscriber

#674497 20-Aug-2012 12:09

Already PMed to z2k earlier. Not read yet so sending to 2degrees too.

Richard rich.ms

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

richms

28198 posts

Uber Geek

Trusted

Lifetime subscriber

#674747 20-Aug-2012 19:36

....so... what happened? who cocked up to let this multi step failure of privacy happen?

Richard rich.ms

z2k

320 posts

Ultimate Geek

Trusted

#674780 20-Aug-2012 20:23

richms: ....so... what happened? who cocked up to let this multi step failure of privacy happen?

POB is checking with the team that looks after these emails, will update when there is more information.

z2k

320 posts

Ultimate Geek

Trusted

#675897 23-Aug-2012 12:49

Just an update, it looks like it was an issue with the email template used which has now been corrected.

mattwnz

20173 posts

Uber Geek

#675903 23-Aug-2012 12:56

There was a similar story on fair go last night, where someone was sent someone else details.

NonprayingMantis

6434 posts

Uber Geek

#675919 23-Aug-2012 13:25

isn't this similar to an issue that 2D had a while back, where customers found somebody else's details filled in when they went to log into the 2Degrees website?

richms

28198 posts

Uber Geek

Trusted

Lifetime subscriber

#676008 23-Aug-2012 16:16

Will that correct that my details are on a non ssl server with no authentication or just that I see someone elses details on the link?

Richard rich.ms

minigopher17

281 posts

Ultimate Geek

#676024 23-Aug-2012 16:46

I've had a "privacy breach" with Pizza Hut one time. I logged in to order myself a pizza and it said "Welcome Hamish". I had somehow logged in as a Hamish and could see his personal details and preferred pick-up store.

By the way, my name isn't Hamish. Just saying that all systems out there have issues occasionally.

ChevronX

280 posts

Ultimate Geek

#676025 23-Aug-2012 16:46

richms: Will that correct that my details are on a non ssl server with no authentication or just that I see someone elses details on the link?

The non SSL part might just be routing, I would imagine it is very much protected.

"The Atlantis base, brings greetings from the pegasus galaxy, you may cut power to the gate!."- Dr Weir (Rising) New Zealand · Luke.Geek.NZ

1 | 2