7 ms·
Sales engagement startup Apollo says its massive contacts database was stolen
- i_am_nomad 8y agoThese articles are always a little frustrating, especially to those of us who aren't familiar with data management on that scale. For example, how was the breach carried out? How did the company know it occurred? Was there something the company should have done, but didn't? I understand why those details don't make it into the media, but it's hard not to be curious about it.
- kork__ 8y agoThe details usually are that that someone left ssh wide open, someone else had a look at the logs and though 'Gee I don't think we should have anyone logging in from Belarus', and hiring competent people with enough resources would have prevented this.
- jaxn 8y agoAnd those are important questions, because they get at "how can I make sure this doesn't happen to my company"
- user111233 8y agoIt's probably kept secret because if we knew how easy it was to steal their data that would be bad for their image. Most companies have little to no security other than "no one will think to request this url". Could be a past or present employee who knows all the unprotected systems and wanted to make some extra money selling the data.
- gk1 8y agoThe article talks about notifications and risks to customers of Apollo, but it's not the customers' data that was stolen... It was that of 200 MILLION people who probably never opted into having their contact information packaged and sold to third parties.
- r00fus 8y agoWaiting for GDPR. The information provided while not PII is still pretty useful for say, social engineering. One wonders how much the dataset would go for in the black market.
- ironchef 8y agoName and email are usually considered PII in most of the compliance world, no?
- jamiepenney 8y agoThey are for the purposes of the GDPR.
- skj 8y ago"personal identifying information"... Yeah I'd say name and email qualify!
- gumby 8y agoDoes it apply if they are business contacts (business address/phone number)? After all your company-issued phone isn't personal to you -- it identifies a role ("the purchasing manager for foobartronix") and if you leave that number will reach someone else. I don't know how the "compliance world" treats, that but I bet it's a loophole many many people are trying to squeeze through. (I do actually consider it personal to you. And I am a fan of what GDPR is trying to accomplish, in principle, but it's clear the law doesn't really work yet).
- cosmie 8y agoThat's a really important thing to note. Consumer protection laws don't generally stretch to business contexts. And that's true in a lot of areas - from banking regulations to federal do not call laws. Many B2B marketing companies exist in that gray area, with dubious chains of opt in guarantees that shift liability around in case it comes to it. But it never comes to it, because there just isn't the same level of freely accessible recourse channels available for B2B-oriented concerns.
- avitzurel 8y agoThis smells like someone leaving a DB open to the world (remember the old MongoDB open by default?) I think stealing a whole database raises very serious questions as to how technically this was done and how would you prevent this at your company. Unfortunately "transparency first" aside, companies don't usually release this information which leaves us all wondering how we can better protect our users (outside of having sane defaults, closed by default, no ssh, private networks etc...).
- thefounder 8y agoYou would be surprised to find out how many large companies(i.e top 500) lost theier databases, banks included. Many can be googled but most never made it public or didn't even know what happened to them. Chances are that your contact data has been leaked by several parties already. My conclusion is that you can't secure data unless you make a goal of that and even then it's not a sure thing. All your private networks have multiple public entery points and possibly a coordinator(i.e kubernetes admin). Most ecommerce companies and even payment processing companies think of security as an accessory to their business not a primary concern. If they are too focused on security they loose market share(i.e the vetting takes too much time) The only solution is to consider all unencrypted data public and use encryption at the client level(i.e mobile device).
- fogetti 8y agoThat's why the EU introduced GDPR. So you are legally responsible (and the fines can be pretty steep) if you 'forget' to make the breach public.
- blantonl 8y agoSo is this must be the database that hundreds of relentless SAAS Sales Reps use to send me emails like "Hi there, wanted to bubble this up in your inbox and see if you'd be interested in a convo about your site and how we can increase xxx% revenue with our yyyy solution"
- JunkDNA 8y agoOh you just wait! If you haven't gotten one of these yet, the latest version of this is that they actually send a calendar invitation (through a 3rd party service) for a meeting out of the blue. Gmail will helpfully pencil that time in on your calendar automatically until you go in and delete the event. This prevents legit meetings from being scheduled since people are afraid you have some important sales call. If you're absent minded and click "No" to your RSVP, they know you saw it! Blech!
- browsercoin 8y agoah the "we are drowning in product market fit, so don't pass up this opportunity we are giving you"
- backspace_ 8y agoI am curious how the database was stolen. Did the person(s) who accessed the db delete the database afterwards or did they simply make a copy?
- munk-a 8y agoIdeally yes? It'd be nice to know the people who were so irresponsible with PII data ended up losing it...
- koolba 8y ago> Apollo’s database contains publicly available data, including names, job titles, employers, social media handles, phone numbers and email addresses. It doesn’t include Social Security numbers, financial data or email addresses and passwords, Apollo said. Eh? So are email addresses included or not? They’re listed in both categories.
- wutbrodo 8y agoBased on the grammatical structure of the second sentence, it sounds like they're [email,password] pairs weren't lost, while emails alone may have been.
- farnsworth 8y agoThat's a weird way to say it, it almost seems to imply that a list of passwords was lost, but the passwords aren't associated with emails.
- wutbrodo 8y agoYea agreed, very poorly phrased.
- andrewstuart 8y agoHow? I want to know so I can try to avoid doing something similar.
- adjkant 8y ago> Apollo’s database contains publicly available data, including names, job titles, employers, social media handles, phone numbers and email addresses. It doesn’t include Social Security numbers, financial data or email addresses and passwords, Apollo said. So I guess email addresses are a nullable field?
- isalmon 8y agoMy theory is (I work in this space): - Contact database was stolen - User database with emails+passwords was not Basically it's about the emails that they were scraping / guessing, not their users' emails.
- frereubu 8y agoCan someone with more experience of these things tell me how these breaches are discovered, and how they know what information was taken? I presume it's not an exact science.
- fogetti 8y agoI'd be also interested
- maxxxxx 8y agoI assume some logs show anomalies but I bet a lot of breaches never get discovered. Just noticing a breach probably requires some good practices,
- xianb 8y agoyeah, if you're absolutely inept and have insufficient logging/monitoring, you can't even tell how bad you'd been screwed. kinda like a Dunning Kruger effect of sorts
- maxxxxx 8y agoSome execs also think it's better not to know because they think they won't be responsible then. I have seen this with managers opposing pen testing because they were worried about the consequences of finding vulnerabilities.
- adanto6840 8y agoNot overly experienced with this, but years ago we used to add honeypot email addresses to our databases for a super simple & cheap way to at least get an idea of whether data had been exfiltrated. If you add a new email once a month you can get some 'timing' info, and then could start comparing against logs.
- GaryNumanVevo 8y agothat's actually pretty clever!
- aphroz 8y agoIsn't that data freely available already on their website ? It looks like you can get full name, company, position just by creating a free account. Maybe they just scrapped it.
- ajsharp 8y ago"The email said that company said the breach was discovered weeks after system upgrades in July." Wow. They emailed customers but made no public announcement that people's email addresses and personal info had been stolen and now available on the black market. This is absolutely atrocious incident management and disclosure. I smell a lawsuit, possibly from the state or federal government.
- tonyquart 8y agoI have just read an article that might be useful for everyone who has received multiple calls from legit businesses at http://www.whycall.me/news/my-4500-payday-from-a-telemarketer/ http://www.whycall.me/news/my-4500-payday-from-a-telemarkete.... It's quite difficult, but I think if we could win against those telemarketers, it will feel really good.
- yoaviram 8y agoIf you want to do something about this (and other) negligible organizations, head over to https://opt-out.eu https://opt-out.eu, search for Apollo, and the site will generate a GDPR erasure request that you can send. Disclaimer: I'm one of the site's creators.
- coaxial 8y agoThank you, that was useful.
- anigbrowl 8y agoHow much does data like this trade for on the black market, and do vendors tend to partition it or just pursue quick turnover?