10 ms·

E3 accidentally leaks personal details of journalists, YouTubers and analysts

75 points by Kye 7y ago

SeanBoocock 7y ago
Might be more accurate, despite this being the headline, to change the title to “ESA accidentally leaks...”. The ESA is the trade organization that puts on E3 and the entity that is ultimately responsible for this.
- Kye 7y ago
  While true, the leak was of a list of E3 attendees. The fact that it was of E3 attendees is the key fact. I tried different ways to fit ESA in while maintaining specificity, but all variations came out too long. ESA instead of E3 wouldn't necessarily tell E3 attendees their information was leaked since not everyone knows the ESA puts it on. Personally, I've been around games all my life and had no idea. Headlines are always a compromise. I think the author found a good one.
  - SeanBoocock 7y ago
    Definitely, just want to highlight the ESA as the organization responsible for people who might not be as familiar with the space.
  - deleted 7y ago
    [deleted]
- SilasX 7y ago
  Then we’d have to deal with a torrent of comments about the European Space Agency.
falcolas 7y ago
Given the hate and threats video game journalists and YouTubers already get, I can’t imagine this will have a happy ending. There was recently an incident of a FFXIV streamer being doxed and his (and his children’s) lives threatened for their stance on the latest FFXIV raids. There are some real psychopaths out there.
- akhilcacharya 7y ago
  Are there any other enthusiast groups that are this toxic? I stopped associating with the hobby after GamerGate but in retrospect I should have stopped earlier.
  - larsiusprime 7y ago
    Sports? Arguably massively more toxic. People being murdered over sporting events is a truly ancient phenomenon and even destabilized empires clear back into ancient times (Nearly Half of Constantinople was burned down to the ground in the Greens vs Blues Nika riots).
    - islanderfun 7y ago
      Very good comparison and similarities can be drawn between the target audience. Unfortunately gaming sees deaths too with swatting and what not
      - larsiusprime 7y ago
        If you want to draw a rigorously serious comparison you need to mathematically compare audience sizes and base rates. Don't know how it shakes out but my money is definitely on sports, if for no other reason than that video game fans don't congregate in huge arenas with heavy drinking as often as sports fans do
        islanderfun 7y ago
        Completely agree. Though I can see a future where gaming gives it "competition" in this area. Especially with esports on the rise. Multi million dollar prizes and loyalties forming around these teams.
      - deleted 7y ago
        [deleted]
    - orf 7y ago
noodlesUK 7y ago
Does this entity have dealings in Europe? If so it might be possible for GDPR to apply, and I can see this getting ugly if it does (as I believe it should, they should get massive fines for this).
- johnchristopher 7y ago
  GDPR would apply if the entity had personal information of European citizens.
  - Rafert 7y ago
    They have.
    - johnchristopher 7y ago
      How do you know that (not in the article) and are European citizens on the list ?
      - Rafert 7y ago
        With 2000+ people on that list the chances are pretty high there's at least one European included. At least this Dutch video game journalist complained on Twitter about his data being out there: https://twitter.com/tweakjur/status/1157609578143649792 https://twitter.com/tweakjur/status/1157609578143649792
        johnchristopher 7y ago
        Ah, thanks for that follow-up ^^.
  - dahart 7y ago
    > GDPR would apply if the entity had personal information of European citizens. Not quite, merely having data on an EU citizen is not sufficient to invoke GDPR. To clarify, article 3 of GDPR specifies that it applies to companies that market specifically to EU citizens or specifically monitor EU behavior of their customers. https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ This is taken by many to broadly mean that when an EU citizen purchases something by (for example) a US company where the product is marketed only to US citizens, GDPR does not apply. For example: https://www.gdpreu.org/the-regulation/who-must-comply/ https://www.gdpreu.org/the-regulation/who-must-comply/ “May be insufficient evidence [if] The firm’s website is accessible to EU residents”
shakna 7y ago
> The private details of 2,025 games industry journalists and video producers have been leaked online. Leaking the details of a couple thousand people isn't just a regret. Hopefully as more details come forward ESA actually makes an effort to clean up their mess.
- dleslie 7y ago
  Worse, it's being alleged that they've known the information was publicly accessible for months now. https://mobile.twitter.com/SophNar0747/status/1157457672221995009?s=19 https://mobile.twitter.com/SophNar0747/status/11574576722219... https://mobile.twitter.com/SophNar0747/status/1157492567379972096?s=19 https://mobile.twitter.com/SophNar0747/status/11574925673799...
- SilasX 7y ago
  Only 2000? By Equifax logic ($31 million for 140 million cases), E3 can pay a few hundred bucks and move on.
CM30 7y ago
What's worse is that there was basically no reason for this leak to be possible. I mean, it was apparently a list of all people who'd successfully received a press pass for E3 2019. The leak was in the form of an Excel spreadsheet with that info hosted on their server. So why was it even there? It's not the database they're using on the site; from what I've read that's a standard WordPress install. And the spreadsheet was unlikely to be needed outside the organisation itself. Hence the ideal thing to do would have to be to somehow tie the WordPress DB into whatever system they were using. If that'd been done, the leak could never have happened in this way. Alas they didn't, and by going with the old 'intern takes database details, puts them in a spreadsheet and shares around a link' method, exposed thousands of people's details online. It's basically a perfect case study for the dangers of ad hoc spreadsheet solutions and sharing 'private' links around to distribute customer info. Either way, I wouldn't be surprised if someone did sue them under GDPR or what not at this point.
- Thorrez 7y ago
  >So why was it even there? >The list exists so that publishers and developers can invite analysts and media to events and private viewings that take place during the E3 show. >We provide ESA members and exhibitors a media list on a password-protected exhibitor site so they can invite you to E3 press events, connect with you for interviews, and let you know what they are showcasing.
  - CM30 7y ago
    Well they say it was password protected, but the file could apparently be downloaded without logging in at all: https://twitter.com/RLewisReports/status/1157825611252957184 https://twitter.com/RLewisReports/status/1157825611252957184 And even if it was, it feels like this system was implemented in the worst way possible. Could have been a CMS function that generated the list once credentials were provided or what not.
slang800 7y ago
Does anyone know the technical details of how this happened? Did someone just run a spider on the e3expo.com site and find the publicly accessible URL that way, or did they do something more advanced?
- hello_asdf 7y ago
  There was a direct link to the excel file on the "Helpful Links" page of the E3 Expo site.
  - pbhjpbhj 7y ago
    The OP says: >"Unfortunately, a vulnerability was exploited and that list became public." // If it was just a link to a file on the website them claiming a vulnerability was exploited is like saying "my security system was overcome" if I dropped my wallet on the bus.
    - eswat 7y ago
      Based on the ESA statement it’s probably a case of hanlon's razor where they have nobody on-staff to do a proper incident response. They also said they “shut down the site”, which really meant they removed/hidden the page in WordPress but they didn’t remove the culprit file nor did they take down the E3 website.
deleted 7y ago
[deleted]
8bitsrule 7y ago
The best solution for these 'accidents' is mandatory jail-time for the CTO.
- o-__-o 7y ago
  So when someone underneath you does something dumb, like this, you go to jail? Great way to take your bosses job (or not get that CTO role filled, ever) There is a story on the internet floating around about a man who was caught with a roach 9 years and 7 mo after his last drug charge. Because it happened within 10 years he got life for a roach. Your suggestion, like the law that put roachman away, is stupid and you have made everyone dumber for reading it
  - deleted 7y ago
    [deleted]

75 points by Kye 7y ago

Might be more accurate, despite this being the headline, to change the title to “ESA accidentally leaks...”. The ESA is the trade organization that puts on E3 and the entity that is ultimately responsible for this.

Kye 7y ago
While true, the leak was of a list of E3 attendees. The fact that it was of E3 attendees is the key fact. I tried different ways to fit ESA in while maintaining specificity, but all variations came out too long. ESA instead of E3 wouldn't necessarily tell E3 attendees their information was leaked since not everyone knows the ESA puts it on. Personally, I've been around games all my life and had no idea. Headlines are always a compromise. I think the author found a good one.
- SeanBoocock 7y ago
  Definitely, just want to highlight the ESA as the organization responsible for people who might not be as familiar with the space.
- deleted 7y ago
  [deleted]
SilasX 7y ago
Then we’d have to deal with a torrent of comments about the European Space Agency.

falcolas 7y ago

Given the hate and threats video game journalists and YouTubers already get, I can’t imagine this will have a happy ending. There was recently an incident of a FFXIV streamer being doxed and his (and his children’s) lives threatened for their stance on the latest FFXIV raids. There are some real psychopaths out there.

akhilcacharya 7y ago
Are there any other enthusiast groups that are this toxic? I stopped associating with the hobby after GamerGate but in retrospect I should have stopped earlier.
- larsiusprime 7y ago
  Sports? Arguably massively more toxic. People being murdered over sporting events is a truly ancient phenomenon and even destabilized empires clear back into ancient times (Nearly Half of Constantinople was burned down to the ground in the Greens vs Blues Nika riots).
  - islanderfun 7y ago
    Very good comparison and similarities can be drawn between the target audience. Unfortunately gaming sees deaths too with swatting and what not
    - larsiusprime 7y ago
      If you want to draw a rigorously serious comparison you need to mathematically compare audience sizes and base rates. Don't know how it shakes out but my money is definitely on sports, if for no other reason than that video game fans don't congregate in huge arenas with heavy drinking as often as sports fans do
      - islanderfun 7y ago
        Completely agree. Though I can see a future where gaming gives it "competition" in this area. Especially with esports on the rise. Multi million dollar prizes and loyalties forming around these teams.
    - deleted 7y ago
      [deleted]
  - orf 7y ago

noodlesUK 7y ago

Does this entity have dealings in Europe? If so it might be possible for GDPR to apply, and I can see this getting ugly if it does (as I believe it should, they should get massive fines for this).

johnchristopher 7y ago
GDPR would apply if the entity had personal information of European citizens.
- Rafert 7y ago
  They have.
  - johnchristopher 7y ago
    How do you know that (not in the article) and are European citizens on the list ?
    - Rafert 7y ago
      With 2000+ people on that list the chances are pretty high there's at least one European included. At least this Dutch video game journalist complained on Twitter about his data being out there: https://twitter.com/tweakjur/status/1157609578143649792 https://twitter.com/tweakjur/status/1157609578143649792
      - johnchristopher 7y ago
        Ah, thanks for that follow-up ^^.
- dahart 7y ago
  > GDPR would apply if the entity had personal information of European citizens. Not quite, merely having data on an EU citizen is not sufficient to invoke GDPR. To clarify, article 3 of GDPR specifies that it applies to companies that market specifically to EU citizens or specifically monitor EU behavior of their customers. https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ This is taken by many to broadly mean that when an EU citizen purchases something by (for example) a US company where the product is marketed only to US citizens, GDPR does not apply. For example: https://www.gdpreu.org/the-regulation/who-must-comply/ https://www.gdpreu.org/the-regulation/who-must-comply/ “May be insufficient evidence [if] The firm’s website is accessible to EU residents”

shakna 7y ago

> The private details of 2,025 games industry journalists and video producers have been leaked online. Leaking the details of a couple thousand people isn't just a regret. Hopefully as more details come forward ESA actually makes an effort to clean up their mess.

dleslie 7y ago
Worse, it's being alleged that they've known the information was publicly accessible for months now. https://mobile.twitter.com/SophNar0747/status/1157457672221995009?s=19 https://mobile.twitter.com/SophNar0747/status/11574576722219... https://mobile.twitter.com/SophNar0747/status/1157492567379972096?s=19 https://mobile.twitter.com/SophNar0747/status/11574925673799...
SilasX 7y ago
Only 2000? By Equifax logic ($31 million for 140 million cases), E3 can pay a few hundred bucks and move on.

CM30 7y ago

What's worse is that there was basically no reason for this leak to be possible. I mean, it was apparently a list of all people who'd successfully received a press pass for E3 2019. The leak was in the form of an Excel spreadsheet with that info hosted on their server. So why was it even there? It's not the database they're using on the site; from what I've read that's a standard WordPress install. And the spreadsheet was unlikely to be needed outside the organisation itself. Hence the ideal thing to do would have to be to somehow tie the WordPress DB into whatever system they were using. If that'd been done, the leak could never have happened in this way. Alas they didn't, and by going with the old 'intern takes database details, puts them in a spreadsheet and shares around a link' method, exposed thousands of people's details online. It's basically a perfect case study for the dangers of ad hoc spreadsheet solutions and sharing 'private' links around to distribute customer info. Either way, I wouldn't be surprised if someone did sue them under GDPR or what not at this point.

Thorrez 7y ago
>So why was it even there? >The list exists so that publishers and developers can invite analysts and media to events and private viewings that take place during the E3 show. >We provide ESA members and exhibitors a media list on a password-protected exhibitor site so they can invite you to E3 press events, connect with you for interviews, and let you know what they are showcasing.
- CM30 7y ago
  Well they say it was password protected, but the file could apparently be downloaded without logging in at all: https://twitter.com/RLewisReports/status/1157825611252957184 https://twitter.com/RLewisReports/status/1157825611252957184 And even if it was, it feels like this system was implemented in the worst way possible. Could have been a CMS function that generated the list once credentials were provided or what not.

slang800 7y ago

Does anyone know the technical details of how this happened? Did someone just run a spider on the e3expo.com site and find the publicly accessible URL that way, or did they do something more advanced?

hello_asdf 7y ago
There was a direct link to the excel file on the "Helpful Links" page of the E3 Expo site.
- pbhjpbhj 7y ago
  The OP says: >"Unfortunately, a vulnerability was exploited and that list became public." // If it was just a link to a file on the website them claiming a vulnerability was exploited is like saying "my security system was overcome" if I dropped my wallet on the bus.
  - eswat 7y ago
    Based on the ESA statement it’s probably a case of hanlon's razor where they have nobody on-staff to do a proper incident response. They also said they “shut down the site”, which really meant they removed/hidden the page in WordPress but they didn’t remove the culprit file nor did they take down the E3 website.

deleted 7y ago

[deleted]

8bitsrule 7y ago

The best solution for these 'accidents' is mandatory jail-time for the CTO.

o-__-o 7y ago
So when someone underneath you does something dumb, like this, you go to jail? Great way to take your bosses job (or not get that CTO role filled, ever) There is a story on the internet floating around about a man who was caught with a roach 9 years and 7 mo after his last drug charge. Because it happened within 10 years he got life for a roach. Your suggestion, like the law that put roachman away, is stupid and you have made everyone dumber for reading it
- deleted 7y ago
  [deleted]