7 ms·

It's weird to me that we're hearing about this from the press instead of Instacart. If a suspected data dump of Instacart user data made its way to the dark web

It's weird to me that we're hearing about this from the press instead of Instacart. If a suspected data dump of Instacart user data made its way to the dark web, surely it wouldn't be difficult for Instacart to buy a subset of it and confirm or deny its validity. If I was an Instacart customer, I'd feel a lot more comfortable with a preliminary "we're aware and looking into this" statement from Instacart directly as opposed to doing nothing and telling the press that they don't know anything. When a data dump like this hits the dark web, are companies even legally obligated to look into it?

gkoberger 6y ago
This assumes there was a hack. If there wasn't, then there's nothing they can really do. They couldn't have reached out to customers before, they can't say they're looking into it (because there's nothing to look into), etc. It feels to me that a few people got phished, and their accounts are being sold as proof. The rest could just be fake. (Or, there was a hack, and Instacart handled it badly!)
- dang 6y ago
  Ok, I've edited the title to say what the article actually claims (i.e. its first sentence) rather than the stronger claim in the headline.
EE84M3i 6y ago
I would think that Instacart buying data obtained allegedly illegally -- even though it's allegedly their own data -- is likely a legal minefield. In fact, my understanding is that generally buying a known ill-gotten item is illegal even in meatspace. Does it having originally been yours change that?
- tptacek 6y ago
  Lots of relatively large companies have whole lines of business based on buying dark web account dumps, and, last time I looked into it, the conclusion I reached (I'm not a lawyer, just someone who nerds out on this stuff) is that you're legally safe buying with the intention of recovering your own stolen data. You're probably crim-law safe regardless of whose data you're acquiring, as long as you're not a party to or have any kind of durable relationship with the people stealing the data.
  - tialaramex 6y ago
    Experian's lawyers were apparently comfortable enough with this line of work to buy a company that does it outright (CSID). It was interesting because I'd worked at a startup, which used data from the people CSID had hired and that startup was acquired by Experian. At the startup we'd concluded this work was toxic and it'd be crazy to touch the company, we ensured the arrangement was completely at arm's length yet less than ten years later a huge public company felt it was OK to just buy the whole thing and swallow it.
andrewmunsell 6y ago
For some background on how legal it is to obtain (your own) data dumps, Leonard Bailey (US DOJ) did a great talk at RSA Conference 2020 (I attended this talk in person) on "Human Dimensions of Active Defense": https://www.rsaconference.com/usa/us-2020/agenda/human-dimensions-of-active-defense https://www.rsaconference.com/usa/us-2020/agenda/human-dimen... His talk covers a lot of active defense techniques, and goes over some legal points in this area. Link to the specific section, "Reacquiring Stolen Data": https://youtu.be/CNonofF0_lw?t=2177 https://youtu.be/CNonofF0_lw?t=2177
Animats 6y ago
In California, yes.[1] Instacart has not yet reported this breach to the California attorney general, like they're supposed to.[2] There's a long list of companies with data breaches there. [1] https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82 https://leginfo.legislature.ca.gov/faces/codes_displaySectio... [2] https://www.oag.ca.gov/privacy/databreach/list https://www.oag.ca.gov/privacy/databreach/list
- floatingatoll 6y ago
  To consider one possible scenario in-depth: If it’s a leaked-passwords attack used to compromise an unknown number of accounts that had insecure passwords, is it possible for Instacart to prove a breach occurred to the degree necessary to trigger the notification requirement? Is it even a breach at all, in that scenario? How is Instacart at fault? Is it necessary to integrate with haveibeenpwned to avoid having to publish a new breach notification every day that at least X accounts with an insecure password are accessed without consent? Is this requirement codified in law, or must each business discover it the hard way?
  - Nasrudith 6y ago
    More paranoid sites may ask when they notice unexpected login sources from geolocation not matching up. I have had that a few times with imprecise addresses and getting warnings from gmail about a DC login attempt while attempting a login from another location. Not certain about what is legally expected however.
- elliekelly 6y ago
  Keep in mind that developers hear a user needs to be notified in “the most expedient time possible” and think minutes or hours but the lawyers read that and are thinking days or potentially even weeks in some circumstances. Just because Instacart hasn’t notified anyone yet doesn’t mean they won’t or that they’ve failed to comply with the obligation.
  - gruez 6y ago

gkoberger 6y ago

This assumes there was a hack. If there wasn't, then there's nothing they can really do. They couldn't have reached out to customers before, they can't say they're looking into it (because there's nothing to look into), etc. It feels to me that a few people got phished, and their accounts are being sold as proof. The rest could just be fake. (Or, there was a hack, and Instacart handled it badly!)

dang 6y ago
Ok, I've edited the title to say what the article actually claims (i.e. its first sentence) rather than the stronger claim in the headline.

EE84M3i 6y ago

I would think that Instacart buying data obtained allegedly illegally -- even though it's allegedly their own data -- is likely a legal minefield. In fact, my understanding is that generally buying a known ill-gotten item is illegal even in meatspace. Does it having originally been yours change that?

tptacek 6y ago
Lots of relatively large companies have whole lines of business based on buying dark web account dumps, and, last time I looked into it, the conclusion I reached (I'm not a lawyer, just someone who nerds out on this stuff) is that you're legally safe buying with the intention of recovering your own stolen data. You're probably crim-law safe regardless of whose data you're acquiring, as long as you're not a party to or have any kind of durable relationship with the people stealing the data.
- tialaramex 6y ago
  Experian's lawyers were apparently comfortable enough with this line of work to buy a company that does it outright (CSID). It was interesting because I'd worked at a startup, which used data from the people CSID had hired and that startup was acquired by Experian. At the startup we'd concluded this work was toxic and it'd be crazy to touch the company, we ensured the arrangement was completely at arm's length yet less than ten years later a huge public company felt it was OK to just buy the whole thing and swallow it.

andrewmunsell 6y ago

For some background on how legal it is to obtain (your own) data dumps, Leonard Bailey (US DOJ) did a great talk at RSA Conference 2020 (I attended this talk in person) on "Human Dimensions of Active Defense": https://www.rsaconference.com/usa/us-2020/agenda/human-dimensions-of-active-defense https://www.rsaconference.com/usa/us-2020/agenda/human-dimen... His talk covers a lot of active defense techniques, and goes over some legal points in this area. Link to the specific section, "Reacquiring Stolen Data": https://youtu.be/CNonofF0_lw?t=2177 https://youtu.be/CNonofF0_lw?t=2177

Animats 6y ago

In California, yes.[1] Instacart has not yet reported this breach to the California attorney general, like they're supposed to.[2] There's a long list of companies with data breaches there. [1] https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82 https://leginfo.legislature.ca.gov/faces/codes_displaySectio... [2] https://www.oag.ca.gov/privacy/databreach/list https://www.oag.ca.gov/privacy/databreach/list

floatingatoll 6y ago
To consider one possible scenario in-depth: If it’s a leaked-passwords attack used to compromise an unknown number of accounts that had insecure passwords, is it possible for Instacart to prove a breach occurred to the degree necessary to trigger the notification requirement? Is it even a breach at all, in that scenario? How is Instacart at fault? Is it necessary to integrate with haveibeenpwned to avoid having to publish a new breach notification every day that at least X accounts with an insecure password are accessed without consent? Is this requirement codified in law, or must each business discover it the hard way?
- Nasrudith 6y ago
  More paranoid sites may ask when they notice unexpected login sources from geolocation not matching up. I have had that a few times with imprecise addresses and getting warnings from gmail about a DC login attempt while attempting a login from another location. Not certain about what is legally expected however.
elliekelly 6y ago
Keep in mind that developers hear a user needs to be notified in “the most expedient time possible” and think minutes or hours but the lawyers read that and are thinking days or potentially even weeks in some circumstances. Just because Instacart hasn’t notified anyone yet doesn’t mean they won’t or that they’ve failed to comply with the obligation.
- gruez 6y ago