12 ms·

The personal info of what could be Instacart customers is being sold online

344 points by coloneltcb 6y ago

save_ferris 6y ago
It's weird to me that we're hearing about this from the press instead of Instacart. If a suspected data dump of Instacart user data made its way to the dark web, surely it wouldn't be difficult for Instacart to buy a subset of it and confirm or deny its validity. If I was an Instacart customer, I'd feel a lot more comfortable with a preliminary "we're aware and looking into this" statement from Instacart directly as opposed to doing nothing and telling the press that they don't know anything. When a data dump like this hits the dark web, are companies even legally obligated to look into it?
- gkoberger 6y ago
  This assumes there was a hack. If there wasn't, then there's nothing they can really do. They couldn't have reached out to customers before, they can't say they're looking into it (because there's nothing to look into), etc. It feels to me that a few people got phished, and their accounts are being sold as proof. The rest could just be fake. (Or, there was a hack, and Instacart handled it badly!)
  - dang 6y ago
    Ok, I've edited the title to say what the article actually claims (i.e. its first sentence) rather than the stronger claim in the headline.
- EE84M3i 6y ago
  I would think that Instacart buying data obtained allegedly illegally -- even though it's allegedly their own data -- is likely a legal minefield. In fact, my understanding is that generally buying a known ill-gotten item is illegal even in meatspace. Does it having originally been yours change that?
  - tptacek 6y ago
    Lots of relatively large companies have whole lines of business based on buying dark web account dumps, and, last time I looked into it, the conclusion I reached (I'm not a lawyer, just someone who nerds out on this stuff) is that you're legally safe buying with the intention of recovering your own stolen data. You're probably crim-law safe regardless of whose data you're acquiring, as long as you're not a party to or have any kind of durable relationship with the people stealing the data.
    - tialaramex 6y ago
      Experian's lawyers were apparently comfortable enough with this line of work to buy a company that does it outright (CSID). It was interesting because I'd worked at a startup, which used data from the people CSID had hired and that startup was acquired by Experian. At the startup we'd concluded this work was toxic and it'd be crazy to touch the company, we ensured the arrangement was completely at arm's length yet less than ten years later a huge public company felt it was OK to just buy the whole thing and swallow it.
- andrewmunsell 6y ago
  For some background on how legal it is to obtain (your own) data dumps, Leonard Bailey (US DOJ) did a great talk at RSA Conference 2020 (I attended this talk in person) on "Human Dimensions of Active Defense": https://www.rsaconference.com/usa/us-2020/agenda/human-dimensions-of-active-defense https://www.rsaconference.com/usa/us-2020/agenda/human-dimen... His talk covers a lot of active defense techniques, and goes over some legal points in this area. Link to the specific section, "Reacquiring Stolen Data": https://youtu.be/CNonofF0_lw?t=2177 https://youtu.be/CNonofF0_lw?t=2177
- Animats 6y ago
  In California, yes.[1] Instacart has not yet reported this breach to the California attorney general, like they're supposed to.[2] There's a long list of companies with data breaches there. [1] https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82 https://leginfo.legislature.ca.gov/faces/codes_displaySectio... [2] https://www.oag.ca.gov/privacy/databreach/list https://www.oag.ca.gov/privacy/databreach/list
  - floatingatoll 6y ago
    To consider one possible scenario in-depth: If it’s a leaked-passwords attack used to compromise an unknown number of accounts that had insecure passwords, is it possible for Instacart to prove a breach occurred to the degree necessary to trigger the notification requirement? Is it even a breach at all, in that scenario? How is Instacart at fault? Is it necessary to integrate with haveibeenpwned to avoid having to publish a new breach notification every day that at least X accounts with an insecure password are accessed without consent? Is this requirement codified in law, or must each business discover it the hard way?
    - Nasrudith 6y ago
      More paranoid sites may ask when they notice unexpected login sources from geolocation not matching up. I have had that a few times with imprecise addresses and getting warnings from gmail about a DC login attempt while attempting a login from another location. Not certain about what is legally expected however.
  - elliekelly 6y ago
    Keep in mind that developers hear a user needs to be notified in “the most expedient time possible” and think minutes or hours but the lawyers read that and are thinking days or potentially even weeks in some circumstances. Just because Instacart hasn’t notified anyone yet doesn’t mean they won’t or that they’ve failed to comply with the obligation.
    - gruez 6y ago
deleted 6y ago
[deleted]
DivisionSol 6y ago
Anecdotal: Got hit with a password lock on a pretty unused Instacart account ~7 days ago (Jul 15). Possibly a password leak from another site resulting in a targeted large-scale account access to download customer data from a leaky API? (Baseless commentary.)
- bowmessage 6y ago
  +1 to your anecdote on Jul 16.
- wakkaflokka 6y ago
  Exact same thing happened to me a few weeks earlier - July 2nd. Said my account was locked due to too many unsuccessful login attempts. I hadn’t used Instacart in years. Reminds me to delete unused accounts!
- cco 6y ago
  I had a similar thing happen last week with DoorDash, after the first two I contacted their privacy@ address and requested an account deletion via CCPA.
  - dylan604 6y ago
    Isn't that closing the barn door after the horses left?
    - wastedhours 6y ago
      Not necessarily - if you catch it on unsuccessful login attempts and have no evidence they got into the account, it's likely they moved onto the next email address in their list and you can still go in and delete the account pre-compromise.
- Keverw 6y ago
  Interesting! I get random password resets for Facebook, Instagram and some others... Probably some hackers using a script... Then if people do that, wonder if they also try to signup people? That would explain things maybe... Like some sites don't verify emails for signups, had someone sign me up for Spotify on an email of mine, when I don't have an account using that email. Never verified the email but got login notification emails... I reset the password and deleted the account. Then I get emails saying they are from Anna at Netflix wants to chat with me "If you’d like to chat before you start your subscription"... Idk if they like typed in my email and never finished signing up or what but creepy... I have heard some sites log uncompleted signups even if you never clicked submit. Kinda makes me wonder if these people selling breach data sets would sign people up too then if it's a email someone used elsewhere, to bulk up the numbers of users in their so called breach by adding newly created accounts, along with valid email/passwords harvested from other breaches. Then probably an inflated number would make their dataset be worth more money to people trading the datasets on the dark web I'd guess.
amznthrwaway 6y ago
Well, this also explains why my instacart account got locked the other day for having too many failed attempts to access it.
ajsharp 6y ago
"The company denied there had been a breach of its data." This is about as serious a breach as it gets. To have (or claim) zero knowledge of it is pretty bad. If the details of the story are correct, it would imply the attackers had full database access. I would not be surprised to learn the attack vector was gaining a privileged user's credentials, similar to the Twitter hack.
- MattGaiser 6y ago
  What if the data is mostly faked with the rest scraped from phishing attacks? You can’t prove a negative very easily.
- andykx 6y ago
  It is possible that they phished a few users (or used account details from another leak) and the rest of the data is BS. I don't think they're claiming zero knowledge. They're doing the exact opposite: they're saying they have complete knowledge, and that it simply didn't happen. I hope, for their sake, that they are correct.
- eli 6y ago
  It's worth being precise here. They didn't deny there was a breach, they denied being aware of a breach. They didn't rule it out.
pstrateman 6y ago
Isn't this their business model? /s (kind of)
- andykx 6y ago
  Jokes aside, I thought this was going to be about them selling this information, not a hack.
nwcs 6y ago
One major factor that may be contributing to this: Instacart doesn't offer 2-factor authentication (2FA)
anaphor 6y ago
Does instacart actually store credit card numbers, or just tokens? Why would they need to store the last 4 digits?
- spacebear 6y ago
  To populate the list of credit cards in your account.
- on_and_off 6y ago
  I doubt they store credit card data (who does that ?). Last 4 digits would be to display "Your Visa -5555" in a payment method picker
  - anaphor 6y ago
    Yeah, I just use google pay with them, which shows nothing, so there's nothing for would-be identity thieves to steal except my name and address hopefully.
    - on_and_off 6y ago
      it seems to be credential stuffing anyway, so unless you use the same password for every website (unfortunately lots of people do), you should be safe.
pilingual 6y ago
Back in March I started getting Instacart support emails for "Jocelyn Joans" concerning Redwood City Safeway (not nearby). Instacart.com produced an error when I tried to log in or reset my password. Since my email is unique for Instacart, I hadn't used Instacart in 5 years, and I did not have any Instacart correspondence in my email, there's very likely only one way someone could have accessed my account. I sent an email to legal@ demanding my account be removed and to follow up that it had been done. The support emails stopped but I never heard from Instacart. Edit: added “very likely;” clarity.
- woutr_be 6y ago
  > I sent an email to legal@ demanding my account be removed and to follow up that it had been done. The support emails stopped but I never heard from Instacart after that. I must've send close to 50 of these emails to different companies / services I've used in the past. My request was always the same; a dump of my data, removal of my account and confirmation that my account was removed. To nobody's surprise, I never received a response to any of these requests.
  - WrtCdEvrydy 6y ago
    It might be a little easier now, tell them you're a EU resident... and they have to by GDPR....
    - woutr_be 6y ago
      I don't reside in the EU, but I'm a EU citizen. I've quoted GDPR in those emails, but they don't seem to care. My best guess is that they don't even check the email accounts.
      - WrtCdEvrydy 6y ago
        Next time, use the topic "Looking for your DPO for a GDPR concern"... trust me, someone will read that....
iamyi 6y ago
I am not surprised. Recently I had an issue with Instacart when somehow one of my order was charged back. The Trust team at Instacart insisted that I pay up and refused to investigate their system, after I provided a lot of evidence of how their system is mixing up my account with somebody else’s and there is a bug in their integration with Costco. After more than a week of back and force they closed my account. I decided to reopen it by paying the charged back amount because without it I can shop at Costco. Guess what, after the account was reopened, the other transaction delivered to another person living in another state is still showing up in my account, including t heir other private information like cell phone numbers and CC digits. I decided it’s better to buy from amazon instead of costco with Instacart. It’s beyond me why their trust department refused to investigate their system with obvious evidence for bugs, and I don’t want to text the other person in my account to notify him that his private information has been compromised, because the communication with Instacart made me feel that I am guilty. If you use Instacart to buy from Costco, be aware.
- azemetre 6y ago
  You need to publicly shame them on twitter. That is a massive breach likely happening to other users as well. HN has a decent audience but twitter has an enormous audience. Tag some tech reporters as well for extra fun.
  - tasogare 6y ago
    You need a personal audience for that. Posting on Twitter with 10 followers at best isn’t likely to make it.
    - chris_vancity 6y ago
      not with the right hashtag or mentions
      - sbarre 6y ago
        Why don't you go ahead and do that, and then report back to us on your success.
niftylettuce 6y ago
If you're in NYC, Brooklyn, Long Island, or nearby areas, check out our farm-fresh online grocery service, OurHarvest @ https://ourharvest.com/?coupon=HACKERNEWS https://ourharvest.com/?coupon=HACKERNEWS. Use coupon code HACKERNEWS for 25% off your first order. We have a contactless delivery option at checkout if needed. P.S. I'm the CTO and Co-Founder, if you need anything or have questions, email nick@ourharvest.com, or check out my GitHub at https://github.com/niftylettuce https://github.com/niftylettuce
deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
silver70 6y ago
I stopped using them because they constantly overcharged and I could get -0- response. We'll look into it and that is the end. After seeing the report I tried to change my password and it wouldn't let me. So what do we do? Cancel the credit card on it? That still leaves personal info out there.
silver70 6y ago
I had stopped using them because they always overcharged. I contacted them and got an automated "we'll look into it" then never heard from them again. After reading the report of whatever has happened I tried to change my password. It wouldn't process it. So what now. Cancel the credit card? But other personal information still possibly compromised...
tialaramex 6y ago
I used to deal with this sort of stolen data (wow, it seems like a long time ago now). A big pile arrived every single morning before dawn. At this scale you'd expect to find clear evidence it was Instacart users e.g. an account with email address dave+instacart@davesdomain.example. If there's nothing like that in the data then it's immediately suspicious, a small site might just not have any users with such breadcrumb trails in their email but a big dump like this should statistically have something because there are lots of people (including me) using a breadcrumb for every account. This is how I know for sure that one of the banks I used years ago lost all their customer email/ name data even though they denied this at the time when it was news. I get scam emails to the address I gave them even now. You'd also expect a company that cares about its users data to have plausible looking "watermark" accounts that trip alarms and so they'd be able to confirm this is their data. Even, if they did a proper job, what the source was (e.g. if you send a subset of data to a partner organisation you can add more watermark data and that lets you know if the data is stolen from that partner)
- nsomaru 6y ago
  Have always been curious about this; if you stole data or are using stolen data why wouldn’t you just strip out the breadcrumb?
  - tialaramex 6y ago
    Two answers for that: 1. Crooks are lazy. Actually humans are lazy and crooks are human, but even more so criminal activity doesn't tend to come with any quality control. Even obvious data cleanup like fixing escaping often isn't done, because there's no incentive. 2. Breadcrumbs tend to be obvious to a human but a variety of schemes might be employed which means automation to strip them would need to be relatively sophisticated or it'll miss many of them. I used to use breadcrumbs of the form emanniamodXX@my-breadcrumb-domain.vanity.example where XX is two digits signifying when I updated this email address, like maybe 14 means May/June 2009. A human can stare at that address, see it says domainname backwards and realise it's a breadcrumb. But a trivial regex match will miss it.
BlackjackCF 6y ago
Well, this certainly explains why I keep getting notified by Instacart that someone is failing to log into my account. I'm deleting that garbage now.
deleted 6y ago
[deleted]
bsenftner 6y ago
Online shopping carts are a nightmare of reliability. I've pretty much abandoned my trust of them. I even spent time a few years ago contributing to the Ubercart code base. Something is very fishy in the manner in which financial transactions are handled, as if losses and fraud are expected and baked in.
Program_Install 6y ago
This is very disheartening, I used instacart quite bit during my time onsite in NYC for a contract. I don't know why these companies have an initial reaction of denying anything happened, when in the end all will find out anyway. More egg on the face, just own it and work to be better.
namidark 6y ago
Anecdotally, both credit cards I used on Instacart got popped for fraud right after each other in the past week.
on_and_off 6y ago
fwiw instacart says it is credential stuffing : https://news.instacart.com/a-security-update-from-instacart-89beb7bf5121?gi=b582efd6d23c https://news.instacart.com/a-security-update-from-instacart-...

344 points by coloneltcb 6y ago

It's weird to me that we're hearing about this from the press instead of Instacart. If a suspected data dump of Instacart user data made its way to the dark web, surely it wouldn't be difficult for Instacart to buy a subset of it and confirm or deny its validity. If I was an Instacart customer, I'd feel a lot more comfortable with a preliminary "we're aware and looking into this" statement from Instacart directly as opposed to doing nothing and telling the press that they don't know anything. When a data dump like this hits the dark web, are companies even legally obligated to look into it?

gkoberger 6y ago
This assumes there was a hack. If there wasn't, then there's nothing they can really do. They couldn't have reached out to customers before, they can't say they're looking into it (because there's nothing to look into), etc. It feels to me that a few people got phished, and their accounts are being sold as proof. The rest could just be fake. (Or, there was a hack, and Instacart handled it badly!)
- dang 6y ago
  Ok, I've edited the title to say what the article actually claims (i.e. its first sentence) rather than the stronger claim in the headline.
EE84M3i 6y ago
I would think that Instacart buying data obtained allegedly illegally -- even though it's allegedly their own data -- is likely a legal minefield. In fact, my understanding is that generally buying a known ill-gotten item is illegal even in meatspace. Does it having originally been yours change that?
- tptacek 6y ago
  Lots of relatively large companies have whole lines of business based on buying dark web account dumps, and, last time I looked into it, the conclusion I reached (I'm not a lawyer, just someone who nerds out on this stuff) is that you're legally safe buying with the intention of recovering your own stolen data. You're probably crim-law safe regardless of whose data you're acquiring, as long as you're not a party to or have any kind of durable relationship with the people stealing the data.
  - tialaramex 6y ago
    Experian's lawyers were apparently comfortable enough with this line of work to buy a company that does it outright (CSID). It was interesting because I'd worked at a startup, which used data from the people CSID had hired and that startup was acquired by Experian. At the startup we'd concluded this work was toxic and it'd be crazy to touch the company, we ensured the arrangement was completely at arm's length yet less than ten years later a huge public company felt it was OK to just buy the whole thing and swallow it.
andrewmunsell 6y ago
For some background on how legal it is to obtain (your own) data dumps, Leonard Bailey (US DOJ) did a great talk at RSA Conference 2020 (I attended this talk in person) on "Human Dimensions of Active Defense": https://www.rsaconference.com/usa/us-2020/agenda/human-dimensions-of-active-defense https://www.rsaconference.com/usa/us-2020/agenda/human-dimen... His talk covers a lot of active defense techniques, and goes over some legal points in this area. Link to the specific section, "Reacquiring Stolen Data": https://youtu.be/CNonofF0_lw?t=2177 https://youtu.be/CNonofF0_lw?t=2177
Animats 6y ago
In California, yes.[1] Instacart has not yet reported this breach to the California attorney general, like they're supposed to.[2] There's a long list of companies with data breaches there. [1] https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82 https://leginfo.legislature.ca.gov/faces/codes_displaySectio... [2] https://www.oag.ca.gov/privacy/databreach/list https://www.oag.ca.gov/privacy/databreach/list
- floatingatoll 6y ago
  To consider one possible scenario in-depth: If it’s a leaked-passwords attack used to compromise an unknown number of accounts that had insecure passwords, is it possible for Instacart to prove a breach occurred to the degree necessary to trigger the notification requirement? Is it even a breach at all, in that scenario? How is Instacart at fault? Is it necessary to integrate with haveibeenpwned to avoid having to publish a new breach notification every day that at least X accounts with an insecure password are accessed without consent? Is this requirement codified in law, or must each business discover it the hard way?
  - Nasrudith 6y ago
    More paranoid sites may ask when they notice unexpected login sources from geolocation not matching up. I have had that a few times with imprecise addresses and getting warnings from gmail about a DC login attempt while attempting a login from another location. Not certain about what is legally expected however.
- elliekelly 6y ago
  Keep in mind that developers hear a user needs to be notified in “the most expedient time possible” and think minutes or hours but the lawyers read that and are thinking days or potentially even weeks in some circumstances. Just because Instacart hasn’t notified anyone yet doesn’t mean they won’t or that they’ve failed to comply with the obligation.
  - gruez 6y ago

deleted 6y ago

[deleted]

DivisionSol 6y ago

Anecdotal: Got hit with a password lock on a pretty unused Instacart account ~7 days ago (Jul 15). Possibly a password leak from another site resulting in a targeted large-scale account access to download customer data from a leaky API? (Baseless commentary.)

bowmessage 6y ago
+1 to your anecdote on Jul 16.
wakkaflokka 6y ago
Exact same thing happened to me a few weeks earlier - July 2nd. Said my account was locked due to too many unsuccessful login attempts. I hadn’t used Instacart in years. Reminds me to delete unused accounts!
cco 6y ago
I had a similar thing happen last week with DoorDash, after the first two I contacted their privacy@ address and requested an account deletion via CCPA.
- dylan604 6y ago
  Isn't that closing the barn door after the horses left?
  - wastedhours 6y ago
    Not necessarily - if you catch it on unsuccessful login attempts and have no evidence they got into the account, it's likely they moved onto the next email address in their list and you can still go in and delete the account pre-compromise.
Keverw 6y ago
Interesting! I get random password resets for Facebook, Instagram and some others... Probably some hackers using a script... Then if people do that, wonder if they also try to signup people? That would explain things maybe... Like some sites don't verify emails for signups, had someone sign me up for Spotify on an email of mine, when I don't have an account using that email. Never verified the email but got login notification emails... I reset the password and deleted the account. Then I get emails saying they are from Anna at Netflix wants to chat with me "If you’d like to chat before you start your subscription"... Idk if they like typed in my email and never finished signing up or what but creepy... I have heard some sites log uncompleted signups even if you never clicked submit. Kinda makes me wonder if these people selling breach data sets would sign people up too then if it's a email someone used elsewhere, to bulk up the numbers of users in their so called breach by adding newly created accounts, along with valid email/passwords harvested from other breaches. Then probably an inflated number would make their dataset be worth more money to people trading the datasets on the dark web I'd guess.

amznthrwaway 6y ago

Well, this also explains why my instacart account got locked the other day for having too many failed attempts to access it.

ajsharp 6y ago

"The company denied there had been a breach of its data." This is about as serious a breach as it gets. To have (or claim) zero knowledge of it is pretty bad. If the details of the story are correct, it would imply the attackers had full database access. I would not be surprised to learn the attack vector was gaining a privileged user's credentials, similar to the Twitter hack.

MattGaiser 6y ago
What if the data is mostly faked with the rest scraped from phishing attacks? You can’t prove a negative very easily.
andykx 6y ago
It is possible that they phished a few users (or used account details from another leak) and the rest of the data is BS. I don't think they're claiming zero knowledge. They're doing the exact opposite: they're saying they have complete knowledge, and that it simply didn't happen. I hope, for their sake, that they are correct.
eli 6y ago
It's worth being precise here. They didn't deny there was a breach, they denied being aware of a breach. They didn't rule it out.

pstrateman 6y ago

Isn't this their business model? /s (kind of)

andykx 6y ago
Jokes aside, I thought this was going to be about them selling this information, not a hack.

nwcs 6y ago

One major factor that may be contributing to this: Instacart doesn't offer 2-factor authentication (2FA)

anaphor 6y ago

Does instacart actually store credit card numbers, or just tokens? Why would they need to store the last 4 digits?

spacebear 6y ago
To populate the list of credit cards in your account.
on_and_off 6y ago
I doubt they store credit card data (who does that ?). Last 4 digits would be to display "Your Visa -5555" in a payment method picker
- anaphor 6y ago
  Yeah, I just use google pay with them, which shows nothing, so there's nothing for would-be identity thieves to steal except my name and address hopefully.
  - on_and_off 6y ago
    it seems to be credential stuffing anyway, so unless you use the same password for every website (unfortunately lots of people do), you should be safe.

pilingual 6y ago

Back in March I started getting Instacart support emails for "Jocelyn Joans" concerning Redwood City Safeway (not nearby). Instacart.com produced an error when I tried to log in or reset my password. Since my email is unique for Instacart, I hadn't used Instacart in 5 years, and I did not have any Instacart correspondence in my email, there's very likely only one way someone could have accessed my account. I sent an email to legal@ demanding my account be removed and to follow up that it had been done. The support emails stopped but I never heard from Instacart. Edit: added “very likely;” clarity.

woutr_be 6y ago
> I sent an email to legal@ demanding my account be removed and to follow up that it had been done. The support emails stopped but I never heard from Instacart after that. I must've send close to 50 of these emails to different companies / services I've used in the past. My request was always the same; a dump of my data, removal of my account and confirmation that my account was removed. To nobody's surprise, I never received a response to any of these requests.
- WrtCdEvrydy 6y ago
  It might be a little easier now, tell them you're a EU resident... and they have to by GDPR....
  - woutr_be 6y ago
    I don't reside in the EU, but I'm a EU citizen. I've quoted GDPR in those emails, but they don't seem to care. My best guess is that they don't even check the email accounts.
    - WrtCdEvrydy 6y ago
      Next time, use the topic "Looking for your DPO for a GDPR concern"... trust me, someone will read that....

iamyi 6y ago

I am not surprised. Recently I had an issue with Instacart when somehow one of my order was charged back. The Trust team at Instacart insisted that I pay up and refused to investigate their system, after I provided a lot of evidence of how their system is mixing up my account with somebody else’s and there is a bug in their integration with Costco. After more than a week of back and force they closed my account. I decided to reopen it by paying the charged back amount because without it I can shop at Costco. Guess what, after the account was reopened, the other transaction delivered to another person living in another state is still showing up in my account, including t heir other private information like cell phone numbers and CC digits. I decided it’s better to buy from amazon instead of costco with Instacart. It’s beyond me why their trust department refused to investigate their system with obvious evidence for bugs, and I don’t want to text the other person in my account to notify him that his private information has been compromised, because the communication with Instacart made me feel that I am guilty. If you use Instacart to buy from Costco, be aware.

azemetre 6y ago
You need to publicly shame them on twitter. That is a massive breach likely happening to other users as well. HN has a decent audience but twitter has an enormous audience. Tag some tech reporters as well for extra fun.
- tasogare 6y ago
  You need a personal audience for that. Posting on Twitter with 10 followers at best isn’t likely to make it.
  - chris_vancity 6y ago
    not with the right hashtag or mentions
    - sbarre 6y ago
      Why don't you go ahead and do that, and then report back to us on your success.

niftylettuce 6y ago

If you're in NYC, Brooklyn, Long Island, or nearby areas, check out our farm-fresh online grocery service, OurHarvest @ https://ourharvest.com/?coupon=HACKERNEWS https://ourharvest.com/?coupon=HACKERNEWS. Use coupon code HACKERNEWS for 25% off your first order. We have a contactless delivery option at checkout if needed. P.S. I'm the CTO and Co-Founder, if you need anything or have questions, email nick@ourharvest.com, or check out my GitHub at https://github.com/niftylettuce https://github.com/niftylettuce

deleted 6y ago

[deleted]

deleted 6y ago

[deleted]

silver70 6y ago

I stopped using them because they constantly overcharged and I could get -0- response. We'll look into it and that is the end. After seeing the report I tried to change my password and it wouldn't let me. So what do we do? Cancel the credit card on it? That still leaves personal info out there.

silver70 6y ago

I had stopped using them because they always overcharged. I contacted them and got an automated "we'll look into it" then never heard from them again. After reading the report of whatever has happened I tried to change my password. It wouldn't process it. So what now. Cancel the credit card? But other personal information still possibly compromised...

tialaramex 6y ago

I used to deal with this sort of stolen data (wow, it seems like a long time ago now). A big pile arrived every single morning before dawn. At this scale you'd expect to find clear evidence it was Instacart users e.g. an account with email address dave+instacart@davesdomain.example. If there's nothing like that in the data then it's immediately suspicious, a small site might just not have any users with such breadcrumb trails in their email but a big dump like this should statistically have something because there are lots of people (including me) using a breadcrumb for every account. This is how I know for sure that one of the banks I used years ago lost all their customer email/ name data even though they denied this at the time when it was news. I get scam emails to the address I gave them even now. You'd also expect a company that cares about its users data to have plausible looking "watermark" accounts that trip alarms and so they'd be able to confirm this is their data. Even, if they did a proper job, what the source was (e.g. if you send a subset of data to a partner organisation you can add more watermark data and that lets you know if the data is stolen from that partner)

nsomaru 6y ago
Have always been curious about this; if you stole data or are using stolen data why wouldn’t you just strip out the breadcrumb?
- tialaramex 6y ago
  Two answers for that: 1. Crooks are lazy. Actually humans are lazy and crooks are human, but even more so criminal activity doesn't tend to come with any quality control. Even obvious data cleanup like fixing escaping often isn't done, because there's no incentive. 2. Breadcrumbs tend to be obvious to a human but a variety of schemes might be employed which means automation to strip them would need to be relatively sophisticated or it'll miss many of them. I used to use breadcrumbs of the form emanniamodXX@my-breadcrumb-domain.vanity.example where XX is two digits signifying when I updated this email address, like maybe 14 means May/June 2009. A human can stare at that address, see it says domainname backwards and realise it's a breadcrumb. But a trivial regex match will miss it.

BlackjackCF 6y ago

Well, this certainly explains why I keep getting notified by Instacart that someone is failing to log into my account. I'm deleting that garbage now.

deleted 6y ago

[deleted]

bsenftner 6y ago

Online shopping carts are a nightmare of reliability. I've pretty much abandoned my trust of them. I even spent time a few years ago contributing to the Ubercart code base. Something is very fishy in the manner in which financial transactions are handled, as if losses and fraud are expected and baked in.

Program_Install 6y ago

This is very disheartening, I used instacart quite bit during my time onsite in NYC for a contract. I don't know why these companies have an initial reaction of denying anything happened, when in the end all will find out anyway. More egg on the face, just own it and work to be better.

namidark 6y ago

Anecdotally, both credit cards I used on Instacart got popped for fraud right after each other in the past week.

on_and_off 6y ago

fwiw instacart says it is credential stuffing : https://news.instacart.com/a-security-update-from-instacart-89beb7bf5121?gi=b582efd6d23c https://news.instacart.com/a-security-update-from-instacart-...