7 ms·

Robinhood says millions of customer names, email addresses taken in data breach

190 points by CapitalistCartr 5y ago

optimalsolver 5y ago
Can you complain about theft if you name your company after the most famous thief of all time?
- JohnJamesRambo 5y ago
  Robin Hood gave to the poor, Robinhood takes from the poor. Robinhood sells the poor the constantly disproven dream that you can trade your way to riches.
- datameta 5y ago
  Does it make a difference if the theft happening is to steal from the masses and enrich a lone party?
- artificialLimbs 5y ago
  Robinhood: steals from rich, gives money to poor Poor: "I'm rich!" Robinhood: narrows eyes - "You're what?" Edit: Oh, this is markdown, isn't it?
gruez 5y ago
dupe? https://news.ycombinator.com/item?id=29154328 https://news.ycombinator.com/item?id=29154328
- jedimastert 5y ago
  Yeah, this seems like an article about the blog post with not much extra, except a related reference to a similar Twitter social engineering attack (which, to be fair, I was unaware of). I don't think it adds much, though
donkarma 5y ago
"The company said in a blog post that a malicious hacker had socially engineered a customer service representative over the phone November 3 to get access to customer support systems." Perhaps it is time to actually train customer service techs?
- downrightmike 5y ago
  "Fuck! We have to train them now?! Its bad enough that we have to PAY them!"
  - natpalmer1776 5y ago
    Just make them sign a contract that states if they quit in the next {n} months, they have to pay back the cost of training! You'll offset the cost of training, and help with employee turnover at the SAME TIME! :D /s in case it's necessary.
    - brewdad 5y ago
      I actually signed a contract like that back in the late 90s when Y2K business was starting to build. To be fair, the training involved moving me 2000 miles from home for 3 months and my employer provided my housing and a per diem along with a reasonably intense "boot camp", so they actually spent money on my training. I think I had to stay a year. They kept me for 6 years, so it worked out for both of us.
  - reaperducer 5y ago
    "Fuck! We have to train them now?! Its bad enough that we have to PAY them!" I was surprised to learn how poorly phone reps are paid. Even in America. I work in healthcare, and when COVID hit, almost everyone in the company had to man the phones. We were all e-mailed PDFs from the customer service contractor with instructions about how to use the soft phone system on our computers. Since it was a standard new hire packet, the contractor accidentally left in all of the other workplace policies. Some of which were terrible. For example, the phone reps were only allowed two bathroom breaks each day, and they could total no more than 11 minutes. And this was an American company, with call centers in supposedly "liberal" western states.
ziddoap 5y ago
I enjoyed that in their blog post, instead of the cliché "we care about your security", they included a legal disclaimer about the same length as the initial alert. A nice change of pace.
bluetidepro 5y ago
This is why I love the email wildcard trick you can do with most providers [1]. Now I just update my email in Robinhood to a new wildcard, and then just block all emails to the old one since they will quickly just turn into spam emails 99% of the time. Makes email breaches way less annoying. [1] If you have a service like Gmail or a service that supports wildcards you just do `name+[blahblah]@` or `name.[blahblahblah]@` to make the email specific to the service you are signing up for. So like `bluetidepro+robinhood@` and then if there is a breach you block all emails that go to that, and change your acct to be say `bluetidepro+rh@` or whatever new one so only legit emails go to the new one.
- vadfa 5y ago
  It is much better to buy a domain and do robinhood@bluetidepro.com
  - bluetidepro 5y ago
    Yeah, that also works of course!
- rahimnathwani 5y ago
  This is so common that I'm surprised spammers don't just drop the +xx part of the username.
  - bluetidepro 5y ago
    Yeah, surprised too, but they don't seem to.
  - epanchin 5y ago
    This is common on hacker news and other tech forums. Why waste your time trying to reach the people most likely to ignore your spam.
- lordnacho 5y ago
  Won't the bad people just scan for gmail accounts and take off the wildcard part?
pm90 5y ago
Seems like they don’t have MFA on this customer service tool? Device based security? Don’t mean to pile on but this is not a hard problem to solve; it might cost money, require training etc. It’s scary that this could happen to a supposedly financial institution.
nyxaiur 5y ago
If a big techcorp writes something like "we don't know if your social security number was in the leaked data", assume that your social security number is compromised. Because it basically means the SSNs where in the reach of the hackers and they hope they didn't find it.
deleted 5y ago
[deleted]
mLuby 5y ago
Last year I told Robinhood to "delete (not just close) my account and related data." I hadn't used the service in years and wanted to reduce their annoying "your account statement: still $0" emails as well as to reduce my online exposure to data breaches. Now I get an email from them that not only did they not do what I asked, they did indeed serve my data to criminals. Is there some legal mechanism to compel companies to delete your data rather than this "soft-delete" garbage? Registering an account with a new website these days feels more and more like a stain one will never be able to wash away.
- bogota 5y ago
  Im not sure about your case but if you did any trading in that calendar year they might have been forced to keep your data until they sent out all the required tax forms to customers. If that is not the case then yes its super annoying how hard it is to actually remove your data from websites.
- fpgaminer 5y ago
  I just looked into this, because I tried to delete my account yesterday as well. Normally you can use a CCPA request to nuke your data, but reading Robinhood's T&C it looks like they aren't obligated to delete much since they're a financial institution. Various regulations require them to keep records. So ... we're basically screwed with Robinhood.
- copo233 5y ago
  I don't even have an account with Robinhood. I've never done any business with them but somebody else set up an account with my email address. After taking way too long to have my email removed from that account, they now managed to give it to some criminals as well.
  - hinkley 5y ago
    This is why you verify email addresses. Especially with financial institutions. Mint used to send me somebody else's statements. I don't understand how companies in sober industries can be this reckless.
t8e56vd4ih 5y ago
or ... they just sold the data.
kuya11 5y ago
The repeated debacles of their trading systems going completely down for entire trading days already made me lose trust. I remember clearly their only communication through one of their most major outages was one tweet saying 'sorry' after the market had already closed. I discovered during this time they also had no customer support to call, only an email support system which was backlogged several days. Apparently they do have phone support now that have power to grant anyone access to customer data. Robinhood reminded me of Theranos in that they are ran as tech companies that don't take the usual responsibilities of their respective industries seriously. And their outages make me think they don't take their tech seriously either.
diveanon 5y ago
How is this company still in business? I thought the SEC would step in after the blatant fraud that they perpetrated on the behalf of their real customers during the GME debacle. Now I find out they leaked my name and email after I deleted my account? Is there a class action being formed?
missinfo 5y ago
Uh, why does their customer support even have the ability to pull millions of rows of data?
markus_zhang 5y ago
I think the fundamental issue that we need so much personal information to open an account but there is no law protecting that piece of information. We have to take the fallout by ourselves. I can't really think of anyway to get out of this, except that to use as much tailored information (email and phone can be tailored to a specific financial service, and even address can be, but the most important ones, names and birthdays cannot sadly) as possible.

optimalsolver 5y ago

Can you complain about theft if you name your company after the most famous thief of all time?

JohnJamesRambo 5y ago
Robin Hood gave to the poor, Robinhood takes from the poor. Robinhood sells the poor the constantly disproven dream that you can trade your way to riches.
datameta 5y ago
Does it make a difference if the theft happening is to steal from the masses and enrich a lone party?
artificialLimbs 5y ago
Robinhood: steals from rich, gives money to poor Poor: "I'm rich!" Robinhood: narrows eyes - "You're what?" Edit: Oh, this is markdown, isn't it?

gruez 5y ago

dupe? https://news.ycombinator.com/item?id=29154328 https://news.ycombinator.com/item?id=29154328

jedimastert 5y ago
Yeah, this seems like an article about the blog post with not much extra, except a related reference to a similar Twitter social engineering attack (which, to be fair, I was unaware of). I don't think it adds much, though

donkarma 5y ago

"The company said in a blog post that a malicious hacker had socially engineered a customer service representative over the phone November 3 to get access to customer support systems." Perhaps it is time to actually train customer service techs?

downrightmike 5y ago
"Fuck! We have to train them now?! Its bad enough that we have to PAY them!"
- natpalmer1776 5y ago
  Just make them sign a contract that states if they quit in the next {n} months, they have to pay back the cost of training! You'll offset the cost of training, and help with employee turnover at the SAME TIME! :D /s in case it's necessary.
  - brewdad 5y ago
    I actually signed a contract like that back in the late 90s when Y2K business was starting to build. To be fair, the training involved moving me 2000 miles from home for 3 months and my employer provided my housing and a per diem along with a reasonably intense "boot camp", so they actually spent money on my training. I think I had to stay a year. They kept me for 6 years, so it worked out for both of us.
- reaperducer 5y ago
  "Fuck! We have to train them now?! Its bad enough that we have to PAY them!" I was surprised to learn how poorly phone reps are paid. Even in America. I work in healthcare, and when COVID hit, almost everyone in the company had to man the phones. We were all e-mailed PDFs from the customer service contractor with instructions about how to use the soft phone system on our computers. Since it was a standard new hire packet, the contractor accidentally left in all of the other workplace policies. Some of which were terrible. For example, the phone reps were only allowed two bathroom breaks each day, and they could total no more than 11 minutes. And this was an American company, with call centers in supposedly "liberal" western states.

ziddoap 5y ago

I enjoyed that in their blog post, instead of the cliché "we care about your security", they included a legal disclaimer about the same length as the initial alert. A nice change of pace.

bluetidepro 5y ago

This is why I love the email wildcard trick you can do with most providers [1]. Now I just update my email in Robinhood to a new wildcard, and then just block all emails to the old one since they will quickly just turn into spam emails 99% of the time. Makes email breaches way less annoying. [1] If you have a service like Gmail or a service that supports wildcards you just do `name+[blahblah]@` or `name.[blahblahblah]@` to make the email specific to the service you are signing up for. So like `bluetidepro+robinhood@` and then if there is a breach you block all emails that go to that, and change your acct to be say `bluetidepro+rh@` or whatever new one so only legit emails go to the new one.

vadfa 5y ago
It is much better to buy a domain and do robinhood@bluetidepro.com
- bluetidepro 5y ago
  Yeah, that also works of course!
rahimnathwani 5y ago
This is so common that I'm surprised spammers don't just drop the +xx part of the username.
- bluetidepro 5y ago
  Yeah, surprised too, but they don't seem to.
- epanchin 5y ago
  This is common on hacker news and other tech forums. Why waste your time trying to reach the people most likely to ignore your spam.
lordnacho 5y ago
Won't the bad people just scan for gmail accounts and take off the wildcard part?

pm90 5y ago

Seems like they don’t have MFA on this customer service tool? Device based security? Don’t mean to pile on but this is not a hard problem to solve; it might cost money, require training etc. It’s scary that this could happen to a supposedly financial institution.

nyxaiur 5y ago

If a big techcorp writes something like "we don't know if your social security number was in the leaked data", assume that your social security number is compromised. Because it basically means the SSNs where in the reach of the hackers and they hope they didn't find it.

deleted 5y ago

[deleted]

mLuby 5y ago

Last year I told Robinhood to "delete (not just close) my account and related data." I hadn't used the service in years and wanted to reduce their annoying "your account statement: still $0" emails as well as to reduce my online exposure to data breaches. Now I get an email from them that not only did they not do what I asked, they did indeed serve my data to criminals. Is there some legal mechanism to compel companies to delete your data rather than this "soft-delete" garbage? Registering an account with a new website these days feels more and more like a stain one will never be able to wash away.

bogota 5y ago
Im not sure about your case but if you did any trading in that calendar year they might have been forced to keep your data until they sent out all the required tax forms to customers. If that is not the case then yes its super annoying how hard it is to actually remove your data from websites.
fpgaminer 5y ago
I just looked into this, because I tried to delete my account yesterday as well. Normally you can use a CCPA request to nuke your data, but reading Robinhood's T&C it looks like they aren't obligated to delete much since they're a financial institution. Various regulations require them to keep records. So ... we're basically screwed with Robinhood.
copo233 5y ago
I don't even have an account with Robinhood. I've never done any business with them but somebody else set up an account with my email address. After taking way too long to have my email removed from that account, they now managed to give it to some criminals as well.
- hinkley 5y ago
  This is why you verify email addresses. Especially with financial institutions. Mint used to send me somebody else's statements. I don't understand how companies in sober industries can be this reckless.

t8e56vd4ih 5y ago

or ... they just sold the data.

kuya11 5y ago

The repeated debacles of their trading systems going completely down for entire trading days already made me lose trust. I remember clearly their only communication through one of their most major outages was one tweet saying 'sorry' after the market had already closed. I discovered during this time they also had no customer support to call, only an email support system which was backlogged several days. Apparently they do have phone support now that have power to grant anyone access to customer data. Robinhood reminded me of Theranos in that they are ran as tech companies that don't take the usual responsibilities of their respective industries seriously. And their outages make me think they don't take their tech seriously either.

diveanon 5y ago

How is this company still in business? I thought the SEC would step in after the blatant fraud that they perpetrated on the behalf of their real customers during the GME debacle. Now I find out they leaked my name and email after I deleted my account? Is there a class action being formed?

missinfo 5y ago

Uh, why does their customer support even have the ability to pull millions of rows of data?

markus_zhang 5y ago

I think the fundamental issue that we need so much personal information to open an account but there is no law protecting that piece of information. We have to take the fallout by ourselves. I can't really think of anyway to get out of this, except that to use as much tailored information (email and phone can be tailored to a specific financial service, and even address can be, but the most important ones, names and birthdays cannot sadly) as possible.