15 ms·

Marketing Firm Exactis Leaked a Personal Info Database with 340M Records

429 points by georgecmu 8y ago

azinman2 8y ago
And... no one will go to jail.
- deleted 8y ago
  [deleted]
- microcolonel 8y ago
  Who exactly should go to jail, and what would that help? For all the do-something-ism in the world, doing "something" often amounts to making things worse, while allowing actual avenues for improvement to fester.
  - aalleavitch 8y ago
    What will help?
    - microcolonel 8y ago
      Find a way to use the unique position of the operators of this database to assist those affected in preventing identity theft and other threats which are worsened by the leak. Maybe figure out if there is money out there to account for the cost of that.
  - egypturnash 8y ago
    The CEOs of the company. "Hey, you can get sent to jail for collecting and exposing personal information" would make a lot of people rethink their business models.
- gigatexal 8y ago
  If jail time was a real concern for owning data like this maybe fewer companies would exist owning such data. The he potential for people to use this to steal identities is too high I think
- deleted 8y ago
  [deleted]
hhh 8y ago
With reasonable verification, anyone confirmed to be a part of this breach should be given access to the data, if only for good will. It's a sad state to see that the recklessness (or incompetence) of one entity, and at that a private one, can quickly become a domino in a chain that ends in toppling a person's privacy. They advertise themselves as having the most accurate data (why wouldn't they advertise themselves this way?) If so, the people it affects have a right to know, and it seems that they have the means to contact them and let them know.
- tjoff 8y ago
  With GDPR that would be your legal right.
  - levosmetalo 8y ago
    ... if you are European resident.
    - Normal_gaussian 8y ago
      Correction: if you are physically present in the EU
      - curun1r 8y ago
        Just as medical tourism is a thing, are we going to see privacy tourism emerge as an option? Tour operators can start offering packages... "The sights of Paris and a personal information purge from the 100 largest US collectors"
      - dvlsg 8y ago
        Is physical presence the only requirement to be considered a resident? I thought you had to be a resident in the EU.
        Normal_gaussian 8y ago
psergeant 8y ago
I wonder what’ll happen if they’ve sucked up a bunch of European data too
chatman 8y ago
And, they made fun of RMS... He was telling you what the future holds. This is just a trailer of what is to come.
- jonhendry18 8y ago
  Information wants to be free. That includes information you don't want to be free.
  - dredmorbius 8y ago
    And? ...
  - wglb 8y ago
    Information wants to be free Unless it is about me
  - justwalt 8y ago
    Where do I sign?
- blt 8y ago
  I agree, it is really unfortunate that even people within the software development profession take these issues so lightly.
  - txcwpalpha 8y ago
    I don't think it's so much that software devs take it "lightly". In my experience as a infosec consultant, the bigger problem is that most software devs are too cocky when it comes to security. Most think that security is just a subdomain of computer science (it is not!), and that because they took a crypto class in college, they are 100% qualified to handle the security themselves. They think they are taking it seriously, but they don't understand that knowing how to write software does not make you an expert in securing software. Most devs don't seem to acknowledge that good security requires having a separate, dedicated person/team to handle it, just like how you would hire a lawyer rather than having your software devs handle legal issues. I once posted on HN that every company that deals with sensitive data, big or small, must have a dedicated security person/team. My comment was downvoted/flagged, and I was bombarded with responses like "why would we waste the money on a security person? my dev team already knows to encrypt passwords".
aalleavitch 8y ago
This is laughable. Data security is a fairy-tale. We've all been bought and sold and there is nothing any of us can do to fix it.
- mmiller9 8y ago
  Erm, not opening up this fucking Elasticsearch instance to the entire internet would be a pretty easy way to get like 90% of the way there. I do operations. I can tell you exactly how not to make rookie mistakes like this. But security isn’t sexy, and it isn’t profitable, so it falls by the wayside.
  - aalleavitch 8y ago
    The problem isn’t that these people are incompetent at network security (they are), the problem is that these people had your data to begin with. Data security is impossible because there is a massive shadow market for your entire life history and no amount of privacy setting theater will make up for the fact that your personal data is currently the target of an insatiable feeding frenzy.
  - jonhendry18 8y ago
    Perhaps someone was paid to open the Elasticsearch to the entire internet so that the buyer could grab the data.
  - flukus 8y ago
    > I do operations. I can tell you exactly how not to make rookie mistakes like this But you guys are expensive and management can't tell what you do, so we invented devops to make the developers do it. It worked perfectly until it didn't. Seriously though, as a dev with script kiddie levels of pen-testing skills it's amazing the amount of potential exploits out there. Even where I work with sensitive data it's assumed that the only attack vector is external.
- sidcool 8y ago
  One common theme of all these companies is that they don't want to pay for good talent in security.
mr_spothawk 8y ago
spoiler alert: nobody goes to jail.
- hn_throwaway_99 8y ago
  In all seriousness, what law (in the US) has this company broken? I'm assuming all the data they got was somehow obtained through legal channels in the first place? People may be up in arms about this being a "breach", but think about it: they're a "data brokerage" company. Consider this breach a sale price of $0. My point is what should be scary is that all of this data is bought and sold about all of us, all the time, in the first place.
  - rixrax 8y ago
    Sadly, I think you're right. And in the end, this may just end up being great marketing for the data their selling. Reminds me a startup that I used to work for a while back. We had hired a new hot-shot marketing VP. First thing he does is to purchase 'qualified leads' from some dubious data broker and trumpet how he had generated more leads in his first week than the company had over it's existence. Then the new hot-shot VP of sales hires a couple of inside-sales guys to call through this massive list with a script (which they probably bought from somewhere too since I don't recall recognizing our product from it) provided by new marketing VP. This was a time when people still answered when someone called from unknown number. I remember chatting with the poor inside-sales guys who had to do the calling, and oh boy were they frustrated, but that was nothing compared to how badly the calling was received by people who got the calls. I am pretty sure company got exactly zero sales out of that exercise and probably killed a few future deals too. But I am sure at least marketing VP met his KPIs. Moral of the story: there are shady people out there that are more than happy to pay for all kinds of data sets. I believe that as a society we should exert more control over our data, and companies selling it should be scrutinized, regulated and taxed for doing so.
  - mmiller9 8y ago
    Just because it’s legal doesn’t make it right. No, there is no law against this. That’s a problem, and it will continue to be a problem until it either affects enough CEOs or some Congressman’s kid gets screwed over by it. Until then we’re all going to be forced to clean up the messes ourselves.
tbrock 8y ago
Is there a torrent yet? I want to lookup my own data.
- astura 8y ago
  It was discovered by a white hat; he didn't publicise a data dump.
  - mindslight 8y ago
    s/white/ass/. A white hat, in the context of these surveillance companies, would be Tyler Durden.
    - dang 8y ago
      Could you please not post unsubstantive comments here?
      - mindslight 8y ago
        I was calling attention to the vast difference between what the status quo security industry considers white hat and what free individuals should consider white hat - low corporate pain versus actually closing the hole. As I and others have said elsewhere, the data was leaked the moment it was collected and priced for selling to attackers. Forgoing full disclosure is really just blunting the truth, giving corporate whitewash a leg up, and delaying society learning the lesson of what we're up against. As (presumably) individuals and not owners of surveillance companies, we shouldn't bless this behavior as being in the public interest.
  - jacquesm 8y ago
    Let's hope they were the first to discover it.
    - Rjevski 8y ago
      I hope they were not and this data ends up public. I’d love to search this database for the details of top people at privacy-violating companies and publish them.
axaxs 8y ago
When will this stop? When's the last straw? If I gave a bank 100 dollars, and they lost it, I'd have avenues with which to pursue some sort of justice. If I give a company my data, and they lose it, oh well. I wish all personal data was treated like HIPAA, at a minimum.
- paulie_a 8y ago
  It won't.
  - axaxs 8y ago
    Let's discuss how we can fix this. I'm actually considering leaving my job of 8 years for a probably to be doomed privacy startup. Either way, I'm interested in solutions and more importantly working towards them, even for free.
    - mmiller9 8y ago
      Legislation. We need legal repercussions for people who wantonly mishandle our personal information. Sorry, but the market can’t help us. This kind of shit needs to be illegal yesterday. It’s just impossible because we have a Congress that is so remarkably out of touch that they won’t do anything about it.
      - zeth___ 8y ago
        How so many people are convinced the market will save them from the marker given the last 300 years oh history is beyond me.
        extradego 8y ago
        In America, they simply do not know the last 300 years of history.
        krageon 8y ago
astura 8y ago
What is the source of this data? Without more information I can only assume they are scraping public records just like sites like Spokeo etc. Perhaps with some data analysis thrown in. So I don't see much of a personal concern; especially since their business model appears to be selling this very data!
- greglindahl 8y ago
  I think you're a bit confused by what data Spokeo has. Most of it is generated on the fly when you do a query, by scraping other sources.
  - astura 8y ago
    That's what I mean though. If this data comes from just scraping other sources that are freely and publicly available and applying some shitty data analysis on it, why should I be particularly concerned? The data itself is already out there for someone to find if they wanted to or even buy it from this company if they are too lazy to scrape themselves. However, the source of the data wasn't in the article.
fouc 8y ago
> "I don’t know where the data is coming from, but it’s one of the most comprehensive collections I’ve ever seen" > Each record contains entries that go far beyond contact information and public records to include more than 400 variables on a vast range of specific characteristics: whether the person smokes, their religion, whether they have dogs or cats, and interests as varied as scuba diving and plus-size apparel. It might be "comprehensive" but is it comprehensive in a scary way? It's probably just 400 machine learning features that are estimating what people might like, so not necessarily super accurate?
- reificator 8y ago
  Accuracy doesn't matter. Imagine you're a pastor at a church and a datadump claims you're an atheist. Maybe you can convince people it's a mistake, maybe you can't.
- extradego 8y ago
  > so not necessarily super accurate. Even worse. Many people say they “don’t have anything to hide” because they too haven’t considered the vast consequences regardless of having something to hide. For starters, when the data is inaccurate, you might have something to hide that even you didn’t know about, and it could be responsible for all sorts of events and opportunities in your life both public and private without you even knowing. Things that give you an different life experience than your friends to an unknown degree. This sort of lack of knowledge, control, deprivation of explanation or closure etc. would be the lived experience of chaos and it’s one of the most frightening parts.
- dredmorbius 8y ago
  False or misleading information can also be harmful, if widely disseminated. Birth certificates. Creditworthiness. At the age of 54, Sigmund Arywitz was a healthy American success story. He was making $30,000 a year as executive secretary and treasurer of the Los Angeles County Federation of Labor, AFL-CIO, his family was sound, his reputation high on all counts, and he had just finished eight prestigious years in Sacramento as state labor commissioner under Gov. Edmund G. (Pat) Brown. But something was awry. In the space of one year, five Los Angeles department stores refused Sig Arywitz charge accounts, and a major car-leasing company turned him down for credit -- even though he had a walletful of oil-company and other credit cards and had always paid his bills on time.... 1970 http://www.thedailybeast.com/articles/2013/06/11/is-privacy-dead.html%EF%BB%BF http://www.thedailybeast.com/articles/2013/06/11/is-privacy-... See also: Cardinal Richelieu.
burntrelish1273 8y ago
Every American's DNA was leaked and a malicious AI bot is making a customized oncovirus for each if they visit Washington, D.C. "Oops, our bad. Here's a coupon half-off Tamiflu." Externalities of data breaches keep increasing.
- arpa 8y ago
  You should write a modern cyberpunk story!
  - burntrelish1273 8y ago
    Dick is my middle (nick)name, but my name isn't Philip K. Dick. I'd be turgidly-pressed to write anything comprehensible, much less worth reading. And I'm already starving, I'd have to lop off more than my ears to be a proper starving artist... oh wait, that didn't come out right. Nothing to see here, carry on.
    - arpa 8y ago
      All i'm saying is that i liked your short vision of a possible reality, and i'd love to read even a short story about it. Hell, i'd _write_ a short story about it, although i doubt my english is good enough for anything beyond simple small talk; i envy people with more imagination than i have. That being said, why are you starving, man? I've gone through some of your comments, and it seems you are having some sort of trouble with the mind parasites. I have no idea whether it is possible to pm on hn, but, should you need an anonymous ear, i've been told i am a good listener. Otherwise, i just want to tell you that if you put your mind to it, you will find the source of power inside of you with some help or without, and things are going to work out. Oh, and read mind parasites if you can - it has helped me with my depression quite a bit.
empath75 8y ago
This will continue to happen until the laws change such that holding personal information is a liability, not an asset.
rpearl 8y ago
"exposes" here is quite a strange term, because their entire business is selling that same data. The only difference is that it was briefly available without a price tag.
- mindslight 8y ago
  Exactly! The only thing a "breach" changes is allowing us to actually see the files that Stasi 2.0 are keeping! I'm much more worried about the persistent legally-blessed attacks against our decision making (eg advertising) and financial independence (eg price discrimination), than about receiving backscatter from uncoordinated randos defrauding banks et al. Banks who are responsible for much of this surveillance infrastructure in the first place.
- test6554 8y ago
  That assumes they would sell to absolutely any group including terrorists, hate groups and sanctioned countries. At least without the leak they have the option to refuse.
  - pbhjpbhj 8y ago
    You think they care beyond the colour of the money? Ha, welcome to capitalism my sweet Summer child.
  - wu-ikkyu 8y ago
    >That assumes they would sell to absolutely any group including terrorists, hate groups and sanctioned countries. Shell companies and fronts are a great workaround for that. How do you know who they sell to? And then, after it's been sold the first time, how do you know where the copies of that data are being sold to by the buyer? Turtles all the way down.
rocketperson7 8y ago
Does anyone else feel like this could just be a kind of stunt pulled out of thin air described by "Trust me, I'm lieing"?
rishabhd 8y ago
Where is the american version of GDPR when we need it? This is arguably worse than Equifax one. edit: nope, this is infinitely worse.
- labster 8y ago
  It's coming to California in 2020: https://news.ycombinator.com/item?id=17420849 https://news.ycombinator.com/item?id=17420849
Rjevski 8y ago
Would be good to get a copy of this database to search the details of top executives involved in privacy-violating companies and publish them.
- test6554 8y ago
  Not likely
j16sdiz 8y ago
I still can't understand why leaking SSN should do me harms. These are primary key, not crediential. But everybody is treating them as crediential.
- test6554 8y ago
  Tell me about it. We need a government account that grants access to banks and utilities via oauth or some other cryptographic protocol that allows revocation at will.
  - astura 8y ago
    Except that's a political nonstarter in the US. The military has a 2FA smartcard authentication system that works really well, so it's not like it's infeasible. A number of of very different groups are very opposed to the very idea: libertarians, (some) Christians, and (many) civil rights activist being the most vocal.
- Yokohiii 8y ago
  The reasons for this isn't your privacy. But still it can match you as a person even if your other data is defect or incomplete. A good primary key.
zeroisnowfour 8y ago
"Marketing Firm doxes 340M victims"
reilly3000 8y ago
Information inequity. Whomever has access to this data had an advantage on 340M people, and opportunity to understand and influence them. I think the antithesis of would be information redistribution. Everybody should be entitled to access all of this information if anyone has it. Just for fun lets say the only caveat is that all information access is also public and linked to each identity. Do you think its better off in the hands of the highest bidders???
- stef25 8y ago
  Companies are in some cases (in many cases actually) perfectly allowed to collect user information and from a business perspective would be stupid not to do. Every time you use a loyalty card that information is collected and yes it's used to understand you and perhaps even influence you, to buy certain products. Buying diapers? Have a look at these baby toys. Most people will throw their personal information out there for a price reduction. The problem here is the leak, not the fact that it exists.
  - bdcravens 8y ago
    There is a difference between a company collecting information related to its transactions and a data aggregator.
  - mulmen 8y ago
    When did I buy diapers from Exactis? I’ve never even heard of them. I know exactly what my Safeway card is used for. I also deliberately do not register my phone number or other information to it. Of course they can probably associate it with my credit card but these things are easy to reason about. The real problem is combining all these datasets in one place for the purpose of perpetuating information asymmetry as a product. So actually yes, the problem is that this dataset of every single American exists.
    - stef25 8y ago
      Safeway may outsource the collection and management of this data to a third party and that company may have a lot of clients and hence records of a lot of people. I have no idea if that's what Exactis is / does and people may not be aware of this, but it's the reality. EDIT looks like Exactis gets information on users through cookies, which is not the scenario I wanted to highlight.
jonhendry18 8y ago
So what are the odds someone at Exactis was paid off to loosen the access controls and provide relevant access info to the buyer? A lot of people would probably do that for a chunk of money. Starting to think that with databases like this, any configuration change that involves exposure to the internet should involve two company officers turning keys like in a nuclear missile launch.
achillean 8y ago
There is currently 904.8 TB of data available on Internet-exposed Elastic clusters. Here is an overview of where these servers are located: https://www.shodan.io/report/yhaN9gje https://www.shodan.io/report/yhaN9gje
- mtremsal 8y ago
  2.6MB per person on average? That's a lot of personal data...
  - INTPenis 8y ago
    An exposed elasticsearch server does not equal personal data though. It can be used for anything really. I have two systems that use ES and none of them for personal data.
codedokode 8y ago
It is obvious that selling customers' data gives more profit than not selling. No wonder that in countries with little regulation personal data are collected and sold in mass. It is the most profitable strategy for companies that have those data.
jimjimjim 8y ago
there is never any punishment for corporations. death's too good for them.
- castis 8y ago
  What a shitty thing to say. Suggesting that death is a reasonable response to this is absurd.
  - jacquesm 8y ago
    A corporation dying is the equivalent of revoking their corporate charter, no reason to respond as though we're talking about actual people.
mic47 8y ago
I think that the right title should be "Marketing Firm Exactis Exposed a Personal Info Database with with 340M Records on Internet". This is not a leak, at least there is no evidence of it yet. While this does not downplay this security "mishap", there is still big difference between "someone rob a bank" and "bank left their vaults open". OTOH, it would be interesting to know how did they get hold on such data.
- pbhjpbhj 8y ago
  Unusually for me I find your pedantry here too quibbling - even if the bank is left open taking the money is still theft (robbery is with threats/force in my jurisdiction, UK).
  - azeotropic 8y ago
    The point is there's no evidence a robbery occurred. Someone phoned the bank and told them they saw the vault was left open and that they had better count the money. Nobody knows whether anything was taken yet.
    - spydum 8y ago
      What is messed up is if the firm doesn't have sufficient visibility/logging, they can claim "no evidence" the data was accessed (purely because they Had their eyes closed). IMHO that is negligent - but sadly the various laws tend to support it.
    - pixl97 8y ago
      The problem here is it may be impossible to know if anything was taken. If theft occurs at a bank, the money is gone. If I steal information, the information is still there. Knowledge of theft is completely dependent on a logging system capturing the correct information.
  - astura 8y ago
    Except what happened here was someone left the vault open and a passerby called the bank and the cops to let them know.
ur-whale 8y ago
Obligatory flashback: https://www.wired.com/1999/01/sun-on-privacy-get-over-it/ https://www.wired.com/1999/01/sun-on-privacy-get-over-it/
St0neRed 8y ago
TESt
hopeless 8y ago
A lot of people complained that GDPR was too onerous on small firms and that they should be exempt. According to LinkedIn https://ie.linkedin.com/company/exactis-llc https://ie.linkedin.com/company/exactis-llc Exactis has just 10 employees (obviously some error possible. Call it 15-20?) Now do you think small firms can’t hold large quantities of damaging data?
- lucb1e 8y ago
  That sounds a lot like "I told you so" tone when I still disagree with you. But in case you're here to talk about it and not just to assert your version of the truth, no, I don't think anyone ever claimed that small corps are a loophole. Then big corps would just delegate it to a shell company and be done with it. European law is, to the best of my knowledge, fairly reasonable: if you do something wrong regarding privacy either because you didn't know (like, you tried to follow GDPR but missed something) or do a small thing, you won't get ridiculous fines. But if you're a 10 person company working with huge amounts of personal data and you were grossly negligent, then of course they'll look at that differently from a 10 man company that produces pencils for retailers and incorrectly stored customer's delivery addresses.
  - faho 8y ago
    What I'd love to know is how much of that is codified law (as in in the actual act) as opposed to just expected to come from reasonable courts.
    - hydrox24 8y ago
      Courts will always base their decisions on case law, and I suspect that you can reasonably expect a certain kind of GDPR case law to arise, given what the standing case law is already.
      - JeanMarcS 8y ago
        The French CNIL just fined an association for 75,000 € for a leak in their data. It was a 2017 case, but I guess it will reflect what can happen ?
asimpletune 8y ago
I think a lot of these incentives could be resolved by just treating data as a liability.
auslander 8y ago
Don't forget that you leaked all that info in the first place. Do you use ad-blocker, vpn, private browsing, same on the phone too? All privacy settings in facebook, avoiging gmail and google? No? At least teach your kids to.
- seandougall 8y ago
  You go through all that trouble, and yet ... you have a Facebook account? Anyway, the info being leaked here isn't dependent on browsing history. Companies have been gathering these sorts of profiles far longer than most people have been using the Internet. The only way to avoid it is not just to never have Internet access at all, but never have a credit card or a bank account, never own a house or sign a lease, never drive a car, never register to vote, etc. If you do any of those things, even temporarily, you could be leaking information that can't be unleaked.
  - auslander 8y ago
    True, its impossible to stop banking leaks. I recently found that Visa and MCard sell not only transaction totals, but Itemised data, like eggs, 2x milks, chocolate brand. I guess I'll fill my wallet with cash for shopping. Many people cannot jump off facebook. I just use Messenger for comms. And its no trouble, after setting all up, in few months, you'll hardly notice it, it will be new normal. Forgot to add, use several emails, one for government, one for facebook, for ones you will not use, like shop and blog accounts - create few protonmail ones, it will be harder to put them all together by data mining. If registration page asks, give fake names, DOB, phone numbers. Make it a habit asking yourself - do this shop really needs this data be real?
gregjwild 8y ago
More and more this just feels like the modern crisis of capitalism. The declining rate of profit is so extreme that we have to institute a corporate marketing panopticon designed to sell you shit you don't need, to the extent we're willing to risk that panopticon leaking dangerous information to non-state actors that could lead to theft, extortion, or worse. And we're not even beginning to think about what this can be used for by authoritarian regimes (cf. https://www.madamasr.com/en/2014/09/29/opinion/u/you-are-being-watched-egypts-mass-internet-surveillance/ https://www.madamasr.com/en/2014/09/29/opinion/u/you-are-bei...)
- wu-ikkyu 8y ago
  >And we're not even beginning to think about what this can be used for by authoritarian regimes "Big data" was crucial to the operational efficiency of the Holocaust https://en.m.wikipedia.org/wiki/IBM_and_the_Holocaust https://en.m.wikipedia.org/wiki/IBM_and_the_Holocaust
usermac 8y ago
This always makes me think that if we had a semantic web that this would be unnecessary. I know, I know, that's unrealistic but hear me out. It means that you wouldn't have to hoard data such as in this case. Yeah I know, terrible idea but I think about this logic.
AndyMcConachie 8y ago
It's interesting that we consider this a leak only when the marketing firm loses the data. If we lived in a just society we would consider it a leak once the marketing firm got the data.
- JoeAltmaier 8y ago
  And what really changed? They used to sell the data, right? Now everybody has it (instead of only a percent). Is that worse?
  - cmpb 8y ago
    This is pretty much where I’m at as well, on this issue. I only wish there were social security numbers contained in the breach so that we could stop considering them as personally identifiable info.
    - seandougall 8y ago
      I agree with your meaning, and I think it goes beyond that. SSNs really are PII by definition; what we need to do is stop pretending that we can use any kind of PII in general as a form of authentication. Whether it's SSN, mother's maiden name, or any of these inane "security questions" that (thank goodness) finally seem to be receding from their peak, we need to move away from the fundamentally broken "tell me something about yourself that only you would know" model of authentication.
      - cmpb 8y ago
        Agreed. Thank you for formalizing that ideal more coherently.
- dbllxr 8y ago
  more sad than interesting because we normally don't know when and which firm(s) got our data. I never heard of this company until today.
- 8y ago
JustSomeNobody 8y ago
Fortunately, at this point, with all the leaked data, it's nothing really new that others don't already have. Seriously, though, this is just getting out of control. I'm almost to the point of writing my representatives. I don't think the industry can adequately self-police. [Edit] By "industry" I mean any company who handles my personal data.
mikehollinger 8y ago
From their privacy policy: “In order to be in line with Fair Information Practices we will take the following responsive action, should a data breach occur: We will notify you via email • Within 7 business days We will notify the users via in-site notification • Within 7 business days We also agree to the Individual Redress Principle which requires that individuals have the right to legally pursue enforceable rights against data collectors and processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or government agencies to investigate and/or prosecute non-compliance by data processors.”
mtully 8y ago
As a US citizen, traveling in the EU, what rights do I have under GDPR? Can request data and erasure from Exactis while abroad?
- EuCitizen2018 8y ago
  No, as a US citizen you have no such GDPR protection. If Exactis operates also in the EU, Eu citizens may request their data or erasure of their data from Exactis.
mysterypie 8y ago
Oh, man, another missed opportunity to make the average Joe Six-Pack become aware of data aggregation and privacy violations. If the researcher had downloaded the 2TB of data and published it as a torrent, then laymen might care. When someone can query the list and see his own personal information being broadcast, they will understand. When they realize that anyone can look up the address, phone, and all sorts of other info about their wife, husband, girlfriend, boyfriend, boss, children, or neighbor, they might get an inkling that privacy isn't such a stupid thing to worry about. I realize that we all suffer if it gets made into a torrent, but sometimes pain is necessary to get action. Within a week, this whole thing will be forgotten and nothing will have changed because privacy is too abstract for most people -- they need to see the personal information that's being collected. The researcher acted properly, but going full Snowden would have had much greater impact on getting better privacy-preserving laws and technology.
- smsm42 8y ago
  > If the researcher had downloaded the 2TB of data and published it as a torrent, then laymen might care Nope. In fact, you couldn't be more wrong. The outcome Joe Six-Pack would get from it is not that "data aggregators are dangerous" but that "security researchers, privacy advocates and cyber-criminals are pretty much the same, they are doing the same thing - stealing your data from a honest hard-working marketers - and then hide behind 'privacy' and 'research' when they get caught". And most of the press will run with it gladly, it's an entertaining story. You can't do your cause - whatever it is - worse disservice than to commit crime "to show them". That makes you a criminal - whose argument will be ignored because nobody wants to agree with a criminal - and your cause the one which is promoted by criminals. It's very hard to argue from this position. Sometimes there's no choice - i.e. if the whole enterprise is criminalized in advance, as is criticism of the power in totalitarian states. But nobody smart should put oneself in this position voluntarily. > going full Snowden would have had much greater impact Snowden revealed secrets of the NSA that did not hurt average citizen - on the contrary, in many cases were deployed against the average citizen. In this case, you would be the one directly hurting the average citizen. You wouldn't get the Snowden cape.
- learnstats2 8y ago
394549 8y ago
Has anyone mapped out all of the data brokers that are active in the US, what information they collect, what their sources are? I imagine a lot of that info is proprietary, but I'd really like to understand this industry better. It's probably a foolish hope, but I really hope there are a few main choke points that one could opt-out of. If that's not possible, I could always try to inject bad data into the system, if I know what their inputs are.
DmitryOlshansky 8y ago
Yeah. I’m not a god or smth, but I’m ashamed of “experts” that work(ed?) there. At the very least it’s a pity that even good people make _mistakes_ like that. Untill that day, whatever I do that is at least robust, diesn’t require mainatance each 2-3 months etc. not even fast, just decent. In short while our idustry features stuff like that I will be angry, sad etc. But boy I will always have money, I might have a lot fun at least for some definition of fun!
sorokod 8y ago
William Pearson CTO Will is a highly accomplished IT Executive designing and developing self-service software applications built on BIG Data, running in Cloud Infrastructure in highly secure environments, leveraging analytics and yielding high profits and rapid growth. He is responsible for technology strategy which includes highly accurate and automated data processing, cloud infrastructure, MS Azure platform-as-a-service, Cloudera / Hadoop Data Management Platform, APIs, Marketing Automation Platform, Analytics, and Digital Marketing. ( http://www.exactis.com/about-us/ http://www.exactis.com/about-us/ ) highly ironic
throw23 8y ago
Whats the big deal isn't this going to be same copy of data that was previously leaked in other leaks. What new category of data is leaked in this?
EGreg 8y ago
Why exactly are people not paying more attention to projects like MaidSAFE which are working diligently to solve these problems once and for all? Why do we assume we have to make an arbitrary choice of landlord to trust just so we can get basic things done on the Internet?
djrogers 8y ago
Don't you love it when a conpany you've never heard of turns out to have a ton of personal info on you, and then jsut gives it away?

429 points by georgecmu 8y ago

azinman2 8y ago

And... no one will go to jail.

deleted 8y ago
[deleted]
microcolonel 8y ago
Who exactly should go to jail, and what would that help? For all the do-something-ism in the world, doing "something" often amounts to making things worse, while allowing actual avenues for improvement to fester.
- aalleavitch 8y ago
  What will help?
  - microcolonel 8y ago
    Find a way to use the unique position of the operators of this database to assist those affected in preventing identity theft and other threats which are worsened by the leak. Maybe figure out if there is money out there to account for the cost of that.
- egypturnash 8y ago
  The CEOs of the company. "Hey, you can get sent to jail for collecting and exposing personal information" would make a lot of people rethink their business models.
gigatexal 8y ago
If jail time was a real concern for owning data like this maybe fewer companies would exist owning such data. The he potential for people to use this to steal identities is too high I think
deleted 8y ago
[deleted]

hhh 8y ago

With reasonable verification, anyone confirmed to be a part of this breach should be given access to the data, if only for good will. It's a sad state to see that the recklessness (or incompetence) of one entity, and at that a private one, can quickly become a domino in a chain that ends in toppling a person's privacy. They advertise themselves as having the most accurate data (why wouldn't they advertise themselves this way?) If so, the people it affects have a right to know, and it seems that they have the means to contact them and let them know.

tjoff 8y ago
With GDPR that would be your legal right.
- levosmetalo 8y ago
  ... if you are European resident.
  - Normal_gaussian 8y ago
    Correction: if you are physically present in the EU
    - curun1r 8y ago
      Just as medical tourism is a thing, are we going to see privacy tourism emerge as an option? Tour operators can start offering packages... "The sights of Paris and a personal information purge from the 100 largest US collectors"
    - dvlsg 8y ago
      Is physical presence the only requirement to be considered a resident? I thought you had to be a resident in the EU.
      - Normal_gaussian 8y ago

psergeant 8y ago

I wonder what’ll happen if they’ve sucked up a bunch of European data too

chatman 8y ago

And, they made fun of RMS... He was telling you what the future holds. This is just a trailer of what is to come.

jonhendry18 8y ago
Information wants to be free. That includes information you don't want to be free.
- dredmorbius 8y ago
  And? ...
- wglb 8y ago
  Information wants to be free Unless it is about me
- justwalt 8y ago
  Where do I sign?
blt 8y ago
I agree, it is really unfortunate that even people within the software development profession take these issues so lightly.
- txcwpalpha 8y ago
  I don't think it's so much that software devs take it "lightly". In my experience as a infosec consultant, the bigger problem is that most software devs are too cocky when it comes to security. Most think that security is just a subdomain of computer science (it is not!), and that because they took a crypto class in college, they are 100% qualified to handle the security themselves. They think they are taking it seriously, but they don't understand that knowing how to write software does not make you an expert in securing software. Most devs don't seem to acknowledge that good security requires having a separate, dedicated person/team to handle it, just like how you would hire a lawyer rather than having your software devs handle legal issues. I once posted on HN that every company that deals with sensitive data, big or small, must have a dedicated security person/team. My comment was downvoted/flagged, and I was bombarded with responses like "why would we waste the money on a security person? my dev team already knows to encrypt passwords".

aalleavitch 8y ago

This is laughable. Data security is a fairy-tale. We've all been bought and sold and there is nothing any of us can do to fix it.

mmiller9 8y ago
Erm, not opening up this fucking Elasticsearch instance to the entire internet would be a pretty easy way to get like 90% of the way there. I do operations. I can tell you exactly how not to make rookie mistakes like this. But security isn’t sexy, and it isn’t profitable, so it falls by the wayside.
- aalleavitch 8y ago
  The problem isn’t that these people are incompetent at network security (they are), the problem is that these people had your data to begin with. Data security is impossible because there is a massive shadow market for your entire life history and no amount of privacy setting theater will make up for the fact that your personal data is currently the target of an insatiable feeding frenzy.
- jonhendry18 8y ago
  Perhaps someone was paid to open the Elasticsearch to the entire internet so that the buyer could grab the data.
- flukus 8y ago
  > I do operations. I can tell you exactly how not to make rookie mistakes like this But you guys are expensive and management can't tell what you do, so we invented devops to make the developers do it. It worked perfectly until it didn't. Seriously though, as a dev with script kiddie levels of pen-testing skills it's amazing the amount of potential exploits out there. Even where I work with sensitive data it's assumed that the only attack vector is external.
sidcool 8y ago
One common theme of all these companies is that they don't want to pay for good talent in security.

mr_spothawk 8y ago

spoiler alert: nobody goes to jail.

hn_throwaway_99 8y ago
In all seriousness, what law (in the US) has this company broken? I'm assuming all the data they got was somehow obtained through legal channels in the first place? People may be up in arms about this being a "breach", but think about it: they're a "data brokerage" company. Consider this breach a sale price of $0. My point is what should be scary is that all of this data is bought and sold about all of us, all the time, in the first place.
- rixrax 8y ago
  Sadly, I think you're right. And in the end, this may just end up being great marketing for the data their selling. Reminds me a startup that I used to work for a while back. We had hired a new hot-shot marketing VP. First thing he does is to purchase 'qualified leads' from some dubious data broker and trumpet how he had generated more leads in his first week than the company had over it's existence. Then the new hot-shot VP of sales hires a couple of inside-sales guys to call through this massive list with a script (which they probably bought from somewhere too since I don't recall recognizing our product from it) provided by new marketing VP. This was a time when people still answered when someone called from unknown number. I remember chatting with the poor inside-sales guys who had to do the calling, and oh boy were they frustrated, but that was nothing compared to how badly the calling was received by people who got the calls. I am pretty sure company got exactly zero sales out of that exercise and probably killed a few future deals too. But I am sure at least marketing VP met his KPIs. Moral of the story: there are shady people out there that are more than happy to pay for all kinds of data sets. I believe that as a society we should exert more control over our data, and companies selling it should be scrutinized, regulated and taxed for doing so.
- mmiller9 8y ago
  Just because it’s legal doesn’t make it right. No, there is no law against this. That’s a problem, and it will continue to be a problem until it either affects enough CEOs or some Congressman’s kid gets screwed over by it. Until then we’re all going to be forced to clean up the messes ourselves.

tbrock 8y ago

Is there a torrent yet? I want to lookup my own data.

astura 8y ago
It was discovered by a white hat; he didn't publicise a data dump.
- mindslight 8y ago
  s/white/ass/. A white hat, in the context of these surveillance companies, would be Tyler Durden.
  - dang 8y ago
    Could you please not post unsubstantive comments here?
    - mindslight 8y ago
      I was calling attention to the vast difference between what the status quo security industry considers white hat and what free individuals should consider white hat - low corporate pain versus actually closing the hole. As I and others have said elsewhere, the data was leaked the moment it was collected and priced for selling to attackers. Forgoing full disclosure is really just blunting the truth, giving corporate whitewash a leg up, and delaying society learning the lesson of what we're up against. As (presumably) individuals and not owners of surveillance companies, we shouldn't bless this behavior as being in the public interest.
- jacquesm 8y ago
  Let's hope they were the first to discover it.
  - Rjevski 8y ago
    I hope they were not and this data ends up public. I’d love to search this database for the details of top people at privacy-violating companies and publish them.

axaxs 8y ago

When will this stop? When's the last straw? If I gave a bank 100 dollars, and they lost it, I'd have avenues with which to pursue some sort of justice. If I give a company my data, and they lose it, oh well. I wish all personal data was treated like HIPAA, at a minimum.

paulie_a 8y ago
It won't.
- axaxs 8y ago
  Let's discuss how we can fix this. I'm actually considering leaving my job of 8 years for a probably to be doomed privacy startup. Either way, I'm interested in solutions and more importantly working towards them, even for free.
  - mmiller9 8y ago
    Legislation. We need legal repercussions for people who wantonly mishandle our personal information. Sorry, but the market can’t help us. This kind of shit needs to be illegal yesterday. It’s just impossible because we have a Congress that is so remarkably out of touch that they won’t do anything about it.
    - zeth___ 8y ago
      How so many people are convinced the market will save them from the marker given the last 300 years oh history is beyond me.
      - extradego 8y ago
        In America, they simply do not know the last 300 years of history.
        krageon 8y ago

astura 8y ago

What is the source of this data? Without more information I can only assume they are scraping public records just like sites like Spokeo etc. Perhaps with some data analysis thrown in. So I don't see much of a personal concern; especially since their business model appears to be selling this very data!

greglindahl 8y ago
I think you're a bit confused by what data Spokeo has. Most of it is generated on the fly when you do a query, by scraping other sources.
- astura 8y ago
  That's what I mean though. If this data comes from just scraping other sources that are freely and publicly available and applying some shitty data analysis on it, why should I be particularly concerned? The data itself is already out there for someone to find if they wanted to or even buy it from this company if they are too lazy to scrape themselves. However, the source of the data wasn't in the article.

fouc 8y ago

> "I don’t know where the data is coming from, but it’s one of the most comprehensive collections I’ve ever seen" > Each record contains entries that go far beyond contact information and public records to include more than 400 variables on a vast range of specific characteristics: whether the person smokes, their religion, whether they have dogs or cats, and interests as varied as scuba diving and plus-size apparel. It might be "comprehensive" but is it comprehensive in a scary way? It's probably just 400 machine learning features that are estimating what people might like, so not necessarily super accurate?

reificator 8y ago
Accuracy doesn't matter. Imagine you're a pastor at a church and a datadump claims you're an atheist. Maybe you can convince people it's a mistake, maybe you can't.
extradego 8y ago
> so not necessarily super accurate. Even worse. Many people say they “don’t have anything to hide” because they too haven’t considered the vast consequences regardless of having something to hide. For starters, when the data is inaccurate, you might have something to hide that even you didn’t know about, and it could be responsible for all sorts of events and opportunities in your life both public and private without you even knowing. Things that give you an different life experience than your friends to an unknown degree. This sort of lack of knowledge, control, deprivation of explanation or closure etc. would be the lived experience of chaos and it’s one of the most frightening parts.
dredmorbius 8y ago
False or misleading information can also be harmful, if widely disseminated. Birth certificates. Creditworthiness. At the age of 54, Sigmund Arywitz was a healthy American success story. He was making $30,000 a year as executive secretary and treasurer of the Los Angeles County Federation of Labor, AFL-CIO, his family was sound, his reputation high on all counts, and he had just finished eight prestigious years in Sacramento as state labor commissioner under Gov. Edmund G. (Pat) Brown. But something was awry. In the space of one year, five Los Angeles department stores refused Sig Arywitz charge accounts, and a major car-leasing company turned him down for credit -- even though he had a walletful of oil-company and other credit cards and had always paid his bills on time.... 1970 http://www.thedailybeast.com/articles/2013/06/11/is-privacy-dead.html%EF%BB%BF http://www.thedailybeast.com/articles/2013/06/11/is-privacy-... See also: Cardinal Richelieu.

burntrelish1273 8y ago

Every American's DNA was leaked and a malicious AI bot is making a customized oncovirus for each if they visit Washington, D.C. "Oops, our bad. Here's a coupon half-off Tamiflu." Externalities of data breaches keep increasing.

arpa 8y ago
You should write a modern cyberpunk story!
- burntrelish1273 8y ago
  Dick is my middle (nick)name, but my name isn't Philip K. Dick. I'd be turgidly-pressed to write anything comprehensible, much less worth reading. And I'm already starving, I'd have to lop off more than my ears to be a proper starving artist... oh wait, that didn't come out right. Nothing to see here, carry on.
  - arpa 8y ago
    All i'm saying is that i liked your short vision of a possible reality, and i'd love to read even a short story about it. Hell, i'd _write_ a short story about it, although i doubt my english is good enough for anything beyond simple small talk; i envy people with more imagination than i have. That being said, why are you starving, man? I've gone through some of your comments, and it seems you are having some sort of trouble with the mind parasites. I have no idea whether it is possible to pm on hn, but, should you need an anonymous ear, i've been told i am a good listener. Otherwise, i just want to tell you that if you put your mind to it, you will find the source of power inside of you with some help or without, and things are going to work out. Oh, and read mind parasites if you can - it has helped me with my depression quite a bit.

empath75 8y ago

This will continue to happen until the laws change such that holding personal information is a liability, not an asset.

rpearl 8y ago

"exposes" here is quite a strange term, because their entire business is selling that same data. The only difference is that it was briefly available without a price tag.

mindslight 8y ago
Exactly! The only thing a "breach" changes is allowing us to actually see the files that Stasi 2.0 are keeping! I'm much more worried about the persistent legally-blessed attacks against our decision making (eg advertising) and financial independence (eg price discrimination), than about receiving backscatter from uncoordinated randos defrauding banks et al. Banks who are responsible for much of this surveillance infrastructure in the first place.
test6554 8y ago
That assumes they would sell to absolutely any group including terrorists, hate groups and sanctioned countries. At least without the leak they have the option to refuse.
- pbhjpbhj 8y ago
  You think they care beyond the colour of the money? Ha, welcome to capitalism my sweet Summer child.
- wu-ikkyu 8y ago
  >That assumes they would sell to absolutely any group including terrorists, hate groups and sanctioned countries. Shell companies and fronts are a great workaround for that. How do you know who they sell to? And then, after it's been sold the first time, how do you know where the copies of that data are being sold to by the buyer? Turtles all the way down.

rocketperson7 8y ago

Does anyone else feel like this could just be a kind of stunt pulled out of thin air described by "Trust me, I'm lieing"?

rishabhd 8y ago

Where is the american version of GDPR when we need it? This is arguably worse than Equifax one. edit: nope, this is infinitely worse.

labster 8y ago
It's coming to California in 2020: https://news.ycombinator.com/item?id=17420849 https://news.ycombinator.com/item?id=17420849

Rjevski 8y ago

Would be good to get a copy of this database to search the details of top executives involved in privacy-violating companies and publish them.

test6554 8y ago
Not likely

j16sdiz 8y ago

I still can't understand why leaking SSN should do me harms. These are primary key, not crediential. But everybody is treating them as crediential.

test6554 8y ago
Tell me about it. We need a government account that grants access to banks and utilities via oauth or some other cryptographic protocol that allows revocation at will.
- astura 8y ago
  Except that's a political nonstarter in the US. The military has a 2FA smartcard authentication system that works really well, so it's not like it's infeasible. A number of of very different groups are very opposed to the very idea: libertarians, (some) Christians, and (many) civil rights activist being the most vocal.
Yokohiii 8y ago
The reasons for this isn't your privacy. But still it can match you as a person even if your other data is defect or incomplete. A good primary key.

zeroisnowfour 8y ago

"Marketing Firm doxes 340M victims"

reilly3000 8y ago

Information inequity. Whomever has access to this data had an advantage on 340M people, and opportunity to understand and influence them. I think the antithesis of would be information redistribution. Everybody should be entitled to access all of this information if anyone has it. Just for fun lets say the only caveat is that all information access is also public and linked to each identity. Do you think its better off in the hands of the highest bidders???

stef25 8y ago
Companies are in some cases (in many cases actually) perfectly allowed to collect user information and from a business perspective would be stupid not to do. Every time you use a loyalty card that information is collected and yes it's used to understand you and perhaps even influence you, to buy certain products. Buying diapers? Have a look at these baby toys. Most people will throw their personal information out there for a price reduction. The problem here is the leak, not the fact that it exists.
- bdcravens 8y ago
  There is a difference between a company collecting information related to its transactions and a data aggregator.
- mulmen 8y ago
  When did I buy diapers from Exactis? I’ve never even heard of them. I know exactly what my Safeway card is used for. I also deliberately do not register my phone number or other information to it. Of course they can probably associate it with my credit card but these things are easy to reason about. The real problem is combining all these datasets in one place for the purpose of perpetuating information asymmetry as a product. So actually yes, the problem is that this dataset of every single American exists.
  - stef25 8y ago
    Safeway may outsource the collection and management of this data to a third party and that company may have a lot of clients and hence records of a lot of people. I have no idea if that's what Exactis is / does and people may not be aware of this, but it's the reality. EDIT looks like Exactis gets information on users through cookies, which is not the scenario I wanted to highlight.

jonhendry18 8y ago

So what are the odds someone at Exactis was paid off to loosen the access controls and provide relevant access info to the buyer? A lot of people would probably do that for a chunk of money. Starting to think that with databases like this, any configuration change that involves exposure to the internet should involve two company officers turning keys like in a nuclear missile launch.

achillean 8y ago

There is currently 904.8 TB of data available on Internet-exposed Elastic clusters. Here is an overview of where these servers are located: https://www.shodan.io/report/yhaN9gje https://www.shodan.io/report/yhaN9gje

mtremsal 8y ago
2.6MB per person on average? That's a lot of personal data...
- INTPenis 8y ago
  An exposed elasticsearch server does not equal personal data though. It can be used for anything really. I have two systems that use ES and none of them for personal data.

codedokode 8y ago

It is obvious that selling customers' data gives more profit than not selling. No wonder that in countries with little regulation personal data are collected and sold in mass. It is the most profitable strategy for companies that have those data.

jimjimjim 8y ago

there is never any punishment for corporations. death's too good for them.

castis 8y ago
What a shitty thing to say. Suggesting that death is a reasonable response to this is absurd.
- jacquesm 8y ago
  A corporation dying is the equivalent of revoking their corporate charter, no reason to respond as though we're talking about actual people.

mic47 8y ago

I think that the right title should be "Marketing Firm Exactis Exposed a Personal Info Database with with 340M Records on Internet". This is not a leak, at least there is no evidence of it yet. While this does not downplay this security "mishap", there is still big difference between "someone rob a bank" and "bank left their vaults open". OTOH, it would be interesting to know how did they get hold on such data.

pbhjpbhj 8y ago
Unusually for me I find your pedantry here too quibbling - even if the bank is left open taking the money is still theft (robbery is with threats/force in my jurisdiction, UK).
- azeotropic 8y ago
  The point is there's no evidence a robbery occurred. Someone phoned the bank and told them they saw the vault was left open and that they had better count the money. Nobody knows whether anything was taken yet.
  - spydum 8y ago
    What is messed up is if the firm doesn't have sufficient visibility/logging, they can claim "no evidence" the data was accessed (purely because they Had their eyes closed). IMHO that is negligent - but sadly the various laws tend to support it.
  - pixl97 8y ago
    The problem here is it may be impossible to know if anything was taken. If theft occurs at a bank, the money is gone. If I steal information, the information is still there. Knowledge of theft is completely dependent on a logging system capturing the correct information.
- astura 8y ago
  Except what happened here was someone left the vault open and a passerby called the bank and the cops to let them know.

ur-whale 8y ago

Obligatory flashback: https://www.wired.com/1999/01/sun-on-privacy-get-over-it/ https://www.wired.com/1999/01/sun-on-privacy-get-over-it/

St0neRed 8y ago

TESt

hopeless 8y ago

A lot of people complained that GDPR was too onerous on small firms and that they should be exempt. According to LinkedIn https://ie.linkedin.com/company/exactis-llc https://ie.linkedin.com/company/exactis-llc Exactis has just 10 employees (obviously some error possible. Call it 15-20?) Now do you think small firms can’t hold large quantities of damaging data?

lucb1e 8y ago
That sounds a lot like "I told you so" tone when I still disagree with you. But in case you're here to talk about it and not just to assert your version of the truth, no, I don't think anyone ever claimed that small corps are a loophole. Then big corps would just delegate it to a shell company and be done with it. European law is, to the best of my knowledge, fairly reasonable: if you do something wrong regarding privacy either because you didn't know (like, you tried to follow GDPR but missed something) or do a small thing, you won't get ridiculous fines. But if you're a 10 person company working with huge amounts of personal data and you were grossly negligent, then of course they'll look at that differently from a 10 man company that produces pencils for retailers and incorrectly stored customer's delivery addresses.
- faho 8y ago
  What I'd love to know is how much of that is codified law (as in in the actual act) as opposed to just expected to come from reasonable courts.
  - hydrox24 8y ago
    Courts will always base their decisions on case law, and I suspect that you can reasonably expect a certain kind of GDPR case law to arise, given what the standing case law is already.
    - JeanMarcS 8y ago
      The French CNIL just fined an association for 75,000 € for a leak in their data. It was a 2017 case, but I guess it will reflect what can happen ?

asimpletune 8y ago

I think a lot of these incentives could be resolved by just treating data as a liability.

auslander 8y ago

Don't forget that you leaked all that info in the first place. Do you use ad-blocker, vpn, private browsing, same on the phone too? All privacy settings in facebook, avoiging gmail and google? No? At least teach your kids to.

seandougall 8y ago
You go through all that trouble, and yet ... you have a Facebook account? Anyway, the info being leaked here isn't dependent on browsing history. Companies have been gathering these sorts of profiles far longer than most people have been using the Internet. The only way to avoid it is not just to never have Internet access at all, but never have a credit card or a bank account, never own a house or sign a lease, never drive a car, never register to vote, etc. If you do any of those things, even temporarily, you could be leaking information that can't be unleaked.
- auslander 8y ago
  True, its impossible to stop banking leaks. I recently found that Visa and MCard sell not only transaction totals, but Itemised data, like eggs, 2x milks, chocolate brand. I guess I'll fill my wallet with cash for shopping. Many people cannot jump off facebook. I just use Messenger for comms. And its no trouble, after setting all up, in few months, you'll hardly notice it, it will be new normal. Forgot to add, use several emails, one for government, one for facebook, for ones you will not use, like shop and blog accounts - create few protonmail ones, it will be harder to put them all together by data mining. If registration page asks, give fake names, DOB, phone numbers. Make it a habit asking yourself - do this shop really needs this data be real?

gregjwild 8y ago

More and more this just feels like the modern crisis of capitalism. The declining rate of profit is so extreme that we have to institute a corporate marketing panopticon designed to sell you shit you don't need, to the extent we're willing to risk that panopticon leaking dangerous information to non-state actors that could lead to theft, extortion, or worse. And we're not even beginning to think about what this can be used for by authoritarian regimes (cf. https://www.madamasr.com/en/2014/09/29/opinion/u/you-are-being-watched-egypts-mass-internet-surveillance/ https://www.madamasr.com/en/2014/09/29/opinion/u/you-are-bei...)

wu-ikkyu 8y ago
>And we're not even beginning to think about what this can be used for by authoritarian regimes "Big data" was crucial to the operational efficiency of the Holocaust https://en.m.wikipedia.org/wiki/IBM_and_the_Holocaust https://en.m.wikipedia.org/wiki/IBM_and_the_Holocaust

usermac 8y ago

This always makes me think that if we had a semantic web that this would be unnecessary. I know, I know, that's unrealistic but hear me out. It means that you wouldn't have to hoard data such as in this case. Yeah I know, terrible idea but I think about this logic.

AndyMcConachie 8y ago

It's interesting that we consider this a leak only when the marketing firm loses the data. If we lived in a just society we would consider it a leak once the marketing firm got the data.

JoeAltmaier 8y ago
And what really changed? They used to sell the data, right? Now everybody has it (instead of only a percent). Is that worse?
- cmpb 8y ago
  This is pretty much where I’m at as well, on this issue. I only wish there were social security numbers contained in the breach so that we could stop considering them as personally identifiable info.
  - seandougall 8y ago
    I agree with your meaning, and I think it goes beyond that. SSNs really are PII by definition; what we need to do is stop pretending that we can use any kind of PII in general as a form of authentication. Whether it's SSN, mother's maiden name, or any of these inane "security questions" that (thank goodness) finally seem to be receding from their peak, we need to move away from the fundamentally broken "tell me something about yourself that only you would know" model of authentication.
    - cmpb 8y ago
      Agreed. Thank you for formalizing that ideal more coherently.
dbllxr 8y ago
more sad than interesting because we normally don't know when and which firm(s) got our data. I never heard of this company until today.
8y ago

JustSomeNobody 8y ago

Fortunately, at this point, with all the leaked data, it's nothing really new that others don't already have. Seriously, though, this is just getting out of control. I'm almost to the point of writing my representatives. I don't think the industry can adequately self-police. [Edit] By "industry" I mean any company who handles my personal data.

mikehollinger 8y ago

From their privacy policy: “In order to be in line with Fair Information Practices we will take the following responsive action, should a data breach occur: We will notify you via email • Within 7 business days We will notify the users via in-site notification • Within 7 business days We also agree to the Individual Redress Principle which requires that individuals have the right to legally pursue enforceable rights against data collectors and processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or government agencies to investigate and/or prosecute non-compliance by data processors.”

mtully 8y ago

As a US citizen, traveling in the EU, what rights do I have under GDPR? Can request data and erasure from Exactis while abroad?

EuCitizen2018 8y ago
No, as a US citizen you have no such GDPR protection. If Exactis operates also in the EU, Eu citizens may request their data or erasure of their data from Exactis.

mysterypie 8y ago

Oh, man, another missed opportunity to make the average Joe Six-Pack become aware of data aggregation and privacy violations. If the researcher had downloaded the 2TB of data and published it as a torrent, then laymen might care. When someone can query the list and see his own personal information being broadcast, they will understand. When they realize that anyone can look up the address, phone, and all sorts of other info about their wife, husband, girlfriend, boyfriend, boss, children, or neighbor, they might get an inkling that privacy isn't such a stupid thing to worry about. I realize that we all suffer if it gets made into a torrent, but sometimes pain is necessary to get action. Within a week, this whole thing will be forgotten and nothing will have changed because privacy is too abstract for most people -- they need to see the personal information that's being collected. The researcher acted properly, but going full Snowden would have had much greater impact on getting better privacy-preserving laws and technology.

smsm42 8y ago
> If the researcher had downloaded the 2TB of data and published it as a torrent, then laymen might care Nope. In fact, you couldn't be more wrong. The outcome Joe Six-Pack would get from it is not that "data aggregators are dangerous" but that "security researchers, privacy advocates and cyber-criminals are pretty much the same, they are doing the same thing - stealing your data from a honest hard-working marketers - and then hide behind 'privacy' and 'research' when they get caught". And most of the press will run with it gladly, it's an entertaining story. You can't do your cause - whatever it is - worse disservice than to commit crime "to show them". That makes you a criminal - whose argument will be ignored because nobody wants to agree with a criminal - and your cause the one which is promoted by criminals. It's very hard to argue from this position. Sometimes there's no choice - i.e. if the whole enterprise is criminalized in advance, as is criticism of the power in totalitarian states. But nobody smart should put oneself in this position voluntarily. > going full Snowden would have had much greater impact Snowden revealed secrets of the NSA that did not hurt average citizen - on the contrary, in many cases were deployed against the average citizen. In this case, you would be the one directly hurting the average citizen. You wouldn't get the Snowden cape.
learnstats2 8y ago

394549 8y ago

Has anyone mapped out all of the data brokers that are active in the US, what information they collect, what their sources are? I imagine a lot of that info is proprietary, but I'd really like to understand this industry better. It's probably a foolish hope, but I really hope there are a few main choke points that one could opt-out of. If that's not possible, I could always try to inject bad data into the system, if I know what their inputs are.

DmitryOlshansky 8y ago

Yeah. I’m not a god or smth, but I’m ashamed of “experts” that work(ed?) there. At the very least it’s a pity that even good people make _mistakes_ like that. Untill that day, whatever I do that is at least robust, diesn’t require mainatance each 2-3 months etc. not even fast, just decent. In short while our idustry features stuff like that I will be angry, sad etc. But boy I will always have money, I might have a lot fun at least for some definition of fun!

sorokod 8y ago

William Pearson CTO Will is a highly accomplished IT Executive designing and developing self-service software applications built on BIG Data, running in Cloud Infrastructure in highly secure environments, leveraging analytics and yielding high profits and rapid growth. He is responsible for technology strategy which includes highly accurate and automated data processing, cloud infrastructure, MS Azure platform-as-a-service, Cloudera / Hadoop Data Management Platform, APIs, Marketing Automation Platform, Analytics, and Digital Marketing. ( http://www.exactis.com/about-us/ http://www.exactis.com/about-us/ ) highly ironic

throw23 8y ago

Whats the big deal isn't this going to be same copy of data that was previously leaked in other leaks. What new category of data is leaked in this?

EGreg 8y ago

Why exactly are people not paying more attention to projects like MaidSAFE which are working diligently to solve these problems once and for all? Why do we assume we have to make an arbitrary choice of landlord to trust just so we can get basic things done on the Internet?

djrogers 8y ago

Don't you love it when a conpany you've never heard of turns out to have a ton of personal info on you, and then jsut gives it away?