30 ms·

Samsung Recent Security Incident

248 points by rock_artist 4y ago

xeromal 4y ago
Just got this email. I love how they don't even try to pay you off. They just show you where to get your free credit report where if you've already accessed it, you're screwed.
- ternaryoperator 4y ago
  Came here to say this. The least they could have done is provide you with a free credit report, regardless of whether you previously used your freebie.
tester756 4y ago
>At Samsung, security is a top priority. Every company, always.
- fsociety 4y ago
  The iconic “yes we do have a security department” doublespeak.
  - cProdigy 4y ago
    hmmm
- zac23or 4y ago
  > At Firefighters, firefighting is our top priority. We recently discovered that our base of operations caught fire and, as the fire hydrants and fire extinguishers did not work, it was incinerated. An absurd, insane message.
  - hedora 4y ago
    > Why did firefighters have my stuff? We know your stuff not catching on fire is important to you. That’s why we gather it up into large fpiles, then do the minimal we’re legally required to technically avoid committing arson. For more information on how we and our trusted partners douse our pile of your stuff with gasoline while using our warehouses to hotbox cigars, weed and crack, see our 1000 page “not stealing and then getting high and catching your stuff on fire policy”.
- dreamcompiler 4y ago
  At Samsung, like at every other company, perception management is a top priority. And we will never understand why managing perceptions while ignoring reality always fails.
akersten 4y ago
> but in some cases, may have affected information such as name, contact and demographic information, date of birth, and That's all you need to steal someone's identity. Major reason why I never give any website my real birthday, and use a password manager to remember all the various "birthdays" I've been required to provide for no ostensible reason. If we wanted to hammer out a quick and effective privacy legislation, it would be: you need a demonstrable reason to ask for someone's birthday (e.g., legal reason to validate you're old enough to open a bank account or whatever), not "i want to send a happy birthday newsletter every year (and also sell it in a package to data brokers)"
- capableweb 4y ago
  > That's all you need to steal someone's identity I wish we could stop propagating the idea that it's possible to "steal someone's identity". No, you cannot take my identity from me, I am who I am, you are who you are. What you can do however, with those details, is tricking companies and committing fraud. But it should not be up to me to make sure companies are not being defrauded, the burden is on them to prevent that. Name, contact information and date of birth are so basic level of information, that if you can commit fraud with just those details, something is seriously wrong as the company you're performing the fraud against. Some countries even have those details publicly for you to find via public websites. So again, if that's all it takes, the company is doing something seriously wrong.
  - dt3ft 4y ago
    In Sweden, this information is public.
    - sigmoid10 4y ago
      I have the feeling this is mostly a US thing, where a social security card with almost nil personal data is widely used for identification. In Europe you won't get very far with a birthday and a name - and you certainly won't get a credit card or anything close to it.
artificialLimbs 4y ago
"...and have engaged a leading outside cybersecurity firm and are coordinating with law enforcement." Sounds like "we got ransomeware'd".
- theteapot 4y ago
  The whole paragraph suggests it more strongly. Specifically why would you say "affected" rather than exposed / accessed?: > FAQ: Can you tell us more about what specifically happened? In late July 2022, an unauthorized third party acquired information from some of Samsung’s U.S. systems. On or around August 4, 2022, we determined through our ongoing investigation that personal information of certain customers was affected. We have taken action to secure the affected systems, and have engaged a leading outside cybersecurity firm and are coordinating with law enforcement.
marcodiego 4y ago
> may have affected information such as name, contact and demographic information, date of birth, and product registration information. No. No matter how safe of how carefully you take your security, a vendor should NOT keep these pieces of my private information with them.
- ProAm 4y ago
  Dont give it to them then,
  - marcodiego 4y ago
    Yes. But it is becoming increasingly difficult with "smart" or "connected" devices. Sometimes you have to fill forms to access services or agree with EULA's with abusive terms. If you disagree with the terms, you become ostracized because everybody else from your circles accepted those terms and nobody is using your open-source/decentralized/federated network or services. You can't expect common people to be reasonable and spontaneously boycott abusive vendors. Most people are not educated enough for that. Among those who are, most don't care. We need laws to prevent this kind of abuse so vendors can't take advantage of people who are willing to share such information even if they are knowledgeable about its implications.
    - ProAm 4y ago
      We don't need laws just dont buy their products. You're asking a business to change it's business practices because you don't like them. Free market.
      - brewdad 4y ago
        It's becoming more and more difficult to do so. I can't remember the last time I bought a piece of electronics that didn't have a EULA. At this point, I half expect my breakfast cereal to come with a T&C.
        4y ago
mrtweetyhack 4y ago
morsch 4y ago
I would like to delete my Samsung account (which I was forced to create to access some feature of my phone). But I can't even access my profile because I'd need to accept some new user agreement which I won't do. I guess I could try sending them a letter.
hedora 4y ago
I love how they don't say how big the breach was, what systems were affected, or how to opt-out of them stealing your personal information and storing it on poorly secured servers: > Why does Samsung have my data? > We collect information necessary to help deliver the best experience possible with our products and services. We know how important privacy is to our customers, and we provide information about how we're planning to use customer data, in strict compliance with relevant privacy laws. You may visit the U.S. Privacy Policy section of our website for more details on how we may obtain data and for what purposes: https://www.samsung.com/us/account/privacy-policy/ https://www.samsung.com/us/account/privacy-policy/.
- notsapiensatall 4y ago
  From that privacy policy: > Information we may collect automatically includes information about >· your device, including MAC address, IP address, log information, device model, hardware model, IMEI number, serial number, subscription information, device settings, connections to other devices, mobile network operator, web browser characteristics, app usage information, sales code, access code, current software version, MNC, subscription information, and randomized, non-persistent and resettable device identifiers, such as Personalized Service ID (or PSID), and advertising IDs, including Google Ad ID; >· your use of the Services, including clickstream data, your interactions with the Services (such as the web pages you visit, search terms, and the apps, services and features you use, download, or purchase), the pages that lead or refer you to the Services, how you use the Services, and dates and times of use of the Services; and >· your use of third-party websites, apps and features that are connected to certain Services. So essentially, they're saying that they can log everything that you do on your device.
  - dietr1ch 4y ago
    I don't even know why I got an email from them to my work email. AFAIK I've never used a samsung device at work and I have dedicated work devices.
    - nulbyte 4y ago
A4ET8a8uTh0 4y ago
This ship kinda sailed after Equifax data breach, but I wish we could make data a real liability ( as in, if you store it, you are on an actual legal hook for it ). 2017 settlement[1] was largely a joke if not an insult to all the affected individuals. The company still operates, no one went to jail and the company got a hard cap on potential claim from affected people. I don't know what the solution is exactly though ( I mean how to effect actual change instead of posting in this forum ). [1]https://www.ftc.gov/enforcement/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/refunds/equifax-data-breach-...
- bee_rider 4y ago
  I guess eventually everybody's data will be leaked (are we there yet?) and companies that would like to make loans will have to come up with some other way of verifying their customers. The credit system is a scam anyway. Oh wow thanks Equifax, you think I should be allowed to go up to my eyeballs in debt. What an honor, I'm flattered.
topicseed 4y ago
> may have affected information such as name, contact and demographic information, date of birth, and product registration information. What falls under "product registration information"?
ncphil 4y ago
Amateurs. Samsung's identity system was f*ed even before this. Only Lenovo/Motorola were worse. _Of course_ they got hacked: they were a big fat (in a purely metaphorical sense), stupid, target. The entire executive suite and board should be swept out and replaced. But that won't happen because those few have a lock on the majority of shares by either owning them outright or being golf partners with the like-minded idiot rest. Their main focus now, as always, is to deflect blame and preserve their positions. Does not inspire confidence in the future of anything. No wonder they can't get the simple things right, like providing clean water to Flint or Jackson. The clowns have taken over the bus and are driving it right over a cliff.
wqeraz 4y ago
Was this related to the Lapsus$ incident, or something else?
vardump 4y ago
Luckily I gave all fake information to Samsung. Because I expected this to happen.
- hayst4ck 4y ago
  From a post above: > your device, including MAC address, IP address, log information, device model, hardware model, IMEI number, serial number, subscription information, device settings, connections to other devices, mobile network operator, web browser characteristics, app usage information, sales code, access code, current software version, MNC, subscription information, and randomized, non-persistent and resettable device identifiers, such as Personalized Service ID (or PSID), and advertising IDs, including Google Ad ID; Regardless of how fake you think the information you gave them is, if you use your phone, there is more than enough information to attain a real identity and connect that to other identities. IMEI alone will uniquely identify your device, and therefore you, and it will be connected to a phone company that is probably willing to sell your data. https://arstechnica.com/tech-policy/2021/03/t-mobile-will-tell-advertisers-how-you-use-the-web-starting-next-month/ https://arstechnica.com/tech-policy/2021/03/t-mobile-will-te...
  - vardump 4y ago
    I wonder what kind of information they got out of my TV. Well, obviously at least IP address. Maybe some viewing habits data. In which case they'll probably conclude I mostly like cartoons about ponies and talking, people rescuing dogs...
    - hayst4ck 4y ago
      TV's can probably scan your local network which means at the very minimum getting MAC addresses which can tell you the manufacturer and maybe more, of various devices on your network.
      - vardump 4y ago
        It can do that all it wants, won't be able to see any other devices on my network. Although it could scan for nearby wifi access points. Maybe also for bluetooth devices. It also got a microphone... Business idea: A service to strip microphones and antennas out of brand new TVs?
deleted 4y ago
[deleted]
shultays 4y ago
Samsung stores demographic information because why not. I wonder how much information is that
drcongo 4y ago
Blows my mind that anyone would buy a Samsung product given their data collection addiction.
parasti 4y ago
Oh, Samsung. I just went through the most insane account recovery process I've ever seen. Tried to register a Samsung account, but my email was already taken. Guess I must have had an account at some point. If you forget your password, you have to provide your name and date of birth to reset it. If you fail to enter the correct details many times, which I somehow did, eventually they will send you the recovery email anyway. When I received it, it was in a language I'd never seen. Then I discovered that it was actually somebody else's account from Indonesia that was using my email address without me ever knowing. So I now have a Samsung account that was someone else's but it was using my email so it was really mine?
- ethbr0 4y ago
  I've got a fairly common Gmail address as my primary. I get all kinds of account sign-ups, and also home purchase paperwork and sheriff's office employment offers, from multiple states. I used to feel bad, and spent a couple years trying to get in contact and correct whoever used my email. Now? Fuck em. If you use my email, it's my account. I just deleted "my" Roku account and unsubscribed to the services attached to it (required to delete an account). Me deleting "your" account is the least-abusive thing I could do if you sign up with my email address.
  - aliqot 4y ago
    >Now? Fuck em. If you use my email, it's my account. I just deleted "my" Roku account and unsubscribed to the services attached to it (required to delete an account). >Me deleting "your" account is the least-abusive thing I could do if you sign up with my email address. This is illegal, CFAA of 1996. Them signing up with your email is a mistake, you deliberately modifying data that isn't your own because of that is illegal.
    - galangalalgol 4y ago
      Signing up for services using other people's email? Or canceling services attached to your iwn email?
    - 4y ago
SoftTalker 4y ago
Coincidentally (?) I got an unsolicited text message yesterday with my "Samsung account verification code."
AdmiralAsshat 4y ago
I feel stupid for ever giving Samsung this much info to begin with. But oh, they had such compelling reasons to do it. Like trading in my old phone to get a deep discount on a new one directly from Samsung, and bypassing all the carrier bullshit! Or locking down all of my devices, so that someone who steals my phone can't factory reset it without supplying my Samsung account credentials!
- NoboruWataya 4y ago
  When I saw this thread I went and checked my inbox to see if I had received an email telling me I was caught by this breach. I haven't, but what I do have are like five emails from my carrier in the last two weeks desperately trying to get me to upgrade to the latest Samsung phone. I have a Samsung from three years ago. I don't want to upgrade or replace it until it actually breaks, as constantly upgrading phones strikes me as wasteful. However, when I see this shit as well as all the Samsung apps they don't let you delete or disable from your phone, I am very tempted to just splash out on a Pixel to install GrapheneOS.
  - SapporoChris 4y ago
    Many of the Samsung devices can be rooted. Example: https://forum.xda-developers.com/t/samsung-galaxy-s8-root-snapdragon-sampwnd.3659305/ https://forum.xda-developers.com/t/samsung-galaxy-s8-root-sn... The forum itself is a good place to start looking.
    - gzer0 4y ago
      I've had the opposite experience. S8, S9 Plus, S22+, all of them for some reason cannot unlock the bootloader. At this point I would recommend a Pixel of any variety. It's much much simpler to root and get GrapheneOS installed. Save yourself the headache (and the data leaks).
Mandatum 4y ago
Having reported a critical bounty, their incident response and disclosure process is a complete shitshow. Absolute mess of a company.
hijohnnylin 4y ago
Just got the email from Samsung saying I was part of the breach. At the end of this (extremely long and excuse-ridden) email they inform me that I'm entitled to a free credit check every year from credit reporting agencies. Can't we just fast forward to the part where they send me a $5 check for the class action settlement? They'd save a ton on legal fees.
- WaitWaitWha 4y ago
  I got the same. I find it insulting to offer a credit check. If I wanted, I would get 20 credit checks just this year. Credit checks are also (mostly) free. Everyone and their mother offers them. Why would that do me any good for checking? How does it remediate or mitigate the loss I have?
  - autoexec 4y ago
    > Everyone and their mother offers them. I'm pretty sure the US government offers them for free, and anyone else doing it "for free" is only using at a means to collect and sell your personal information. Using some random site like getmemyfreecreditcheck.com or whatever is pretty much asking for your privacy to be violated.
    - selectodude 4y ago
      not that annualcreditreport.com feels any less random.
  - revlolz 4y ago
    They aren't even offering one, it's worse than that. They are providing info how to use your one annual free credit check that is gov mandated. They are not offering anything other than notice.
- baldeagle 4y ago
  They are offering the free credit check provided by Uncle Sam- not even footing the bill for one of their own
aborsy 4y ago
How is it that security is a top priority when the company can’t correctly implement basic encryption? Samsung shipped so many millions of phones with insecure encryption: https://eprint.iacr.org/2022/208.pdf https://eprint.iacr.org/2022/208.pdf
jiggawatts 4y ago
Just here to remind everyone that Samsung televisions take screenshots at regular intervals of what you watch and sends this to be stored with the same level of “security”.
- autoexec 4y ago
  Roku does this too. > "Roughly twice per second, a Roku TV captures video “snapshots” in 4K resolution. These snapshots are scanned through a database of content and ads, which allows the exposure to be matched to what is airing. For example, if a streamer is watching an NFL football game and sees an ad for a hard seltzer, Roku’s ACR will know that the ad has appeared on the TV being watched at that time. In this way, the content on screen is automatically recognized, as the technology’s name indicates. The data then is paired with user profile data to link the account watching with the content they’re watching." (https://advertising.roku.com/resources/blog/insights-analysis/acr-the-future-of-tv-and-audience-data# https://advertising.roku.com/resources/blog/insights-analysi...!)
  - cush 4y ago
    This is insane. I can't even imagine being at the meeting where this was proposed "Advertisers want to know when their ads are being viewed" - "We could work with advertisers to have them add some metadata to the output signal, and detect that on the client" "Nah, let's just record everything everyone watches, that way we can harvest the data and sell it to advertisers we haven't yet partnered with in the future" - "Yes, that sounds like a perfectly reasonable thing to do and couldn't possibly have any negative consequences. That is unless consumers have a problem with it..." "Who?"
    - autoexec 4y ago
      I can't believe they thought they needed multiple 4K screenshots every second. What a waste of bandwidth!
      - jiggawatts 4y ago
smm11 4y ago
I was just considering using an old iPhone instead of an S21. Decision made.
WaitWaitWha 4y ago
I requested to have all my info deleted by them. Let's see how long it takes. The email for my request is towards the bottom of this page: https://www.samsung.com/us/support/securityresponsecenter/ https://www.samsung.com/us/support/securityresponsecenter/ I am aware this does not fix the problem of the already stolen data, but it might make the data collection cost/benefit analysis in favor of discarding collection all-together. Maybe. Let me dream, would you?
- jacooper 4y ago
  According to their FAQ, the delete account button removes all of your data from their services.
rvz 4y ago
"We value your privacy" is just a buzzword for these companies.
- TEP_Kim_Il_Sung 4y ago
  Translation: "We value your privacy higher than we value you, because we get to sell it to anyone for top dollar."
derwiki 4y ago
California residents can request their data to be deleted here: https://www.samsung.com/us/privacy/ccpa/ https://www.samsung.com/us/privacy/ccpa/ I was surprised I even had a Samsung account so I can't think of any reason to keep one after this.
- ev1 4y ago
  I received this email to a CCPA "removed" email address.
- brewdad 4y ago
  Mine was linked to my college email. I have no idea how that got linked as I have been out of school for more than 20 years. I may have used it to get a "student" discount at some point in the recent past but who knows?
lizardactivist 4y ago
Other companies keep the lid on when it happens to them. Samsung has the decency to inform you quickly and clearly, gotta give them that.
- fartcannon 4y ago
  No, I won't give them anything. They don't need to take this information. They shouldn't have it. I think they and everyone else collecting data should be held far more accountable than they are for the damage they do when that data leaks.
2OEH8eoCRo0 4y ago
It's a red flag when a company says they are, "in strict compliance with relevant privacy laws." Complying with the law is the bare minimum.
jacooper 4y ago
My reaction to this news. Reset password > get into account > delete the account. A useless account that i shouldn't have used anyway. Pixel + Calyx FTW.
busymom0 4y ago
Can someone explain to me what the purpose of date of birth collection is? If it’s to verify the person is an adult, anyone can just lie. And why not just ask for age or age range instead?
libpcap 4y ago
Was the hacking state-sponsored?
hsbauauvhabzb 4y ago
> nformation such as name, contact and demographic information Nice way to gloss over how much ‘demographic information’ they actually collect…
gkhartman 4y ago
For anyone who stopped using Samsung products and wishes to delete their data: https://privacy.samsung.com/mydata/delete/request https://privacy.samsung.com/mydata/delete/request I couldn't find a way to close an account, but this is probably the next best thing.
zlltt 4y ago
as a Chinese dissident, if CCP got the leaked data and tracked to my identity via my Samsung device and account information. I may be put into CCP's jail for my internet speech. Samsung , your carelessness put many lives in danger!!
gU9x3u8XmQNG 4y ago
Tldr: whilst this incident is absolutely inappropriate; the big business behaviour will not change until users, too, recognise their accountability and responsibility. You purchased that product, accepted it’s usage terms, and supported this behaviour. Accept “some” responsibility in this outcome. — In regards to this security incident; users accepted the terms and conditions, which includes (usually in detail, or lack there of) their handling of the outcome, and impact to you. It’s a horrible situation. Im not saying it’s acceptable. however; I demonstrate so by not supporting (advocating, purchasing, etc) and accepting these outrageous terms. This is not isolated to Samsung… Our home is (wherever possible) a “Samsung” free zone, primarily inspired by their handling of the health incidents in their South Korean factories. Workers sick and dying, directly linked to the workplace. After years of persistent pressure from the families of these workers, the outcome was a payout and a typical “sorry we got caught” announcement. There has also been ongoing large-scale corruption in the head/leaders of the organisation, tied closely to South Korea in it’s entirety. It seems the outcome here is; “you’re really bad, but also really good… we’ll meet somewhere in the middle..”. Ps; am aware that Samsung parts are often included with other brand solutions. Hence “mostly” above. I proactively investigate, and avoid at all costs.
blagie 4y ago
Samsung's disclosure doesn't meet statutory requirements of either jurisdiction I reside in, and Samsung's collection of my information doesn't meet statutory requirements in one of them. I did not set up a Samsung account on my phone or log in, despite constant harassment, and now I got a notice saying my information was compromised.
prvc 4y ago
Does this apply to those who use Samsung devices without having made explicitly registered for an "account" with samsung.com? They must be made to reveal the extent to which keylogging and other surreptitious means of data collection are being used on their devices.

248 points by rock_artist 4y ago

Just got this email. I love how they don't even try to pay you off. They just show you where to get your free credit report where if you've already accessed it, you're screwed.

ternaryoperator 4y ago
Came here to say this. The least they could have done is provide you with a free credit report, regardless of whether you previously used your freebie.

tester756 4y ago

>At Samsung, security is a top priority. Every company, always.

fsociety 4y ago
The iconic “yes we do have a security department” doublespeak.
- cProdigy 4y ago
  hmmm
zac23or 4y ago
> At Firefighters, firefighting is our top priority. We recently discovered that our base of operations caught fire and, as the fire hydrants and fire extinguishers did not work, it was incinerated. An absurd, insane message.
- hedora 4y ago
  > Why did firefighters have my stuff? We know your stuff not catching on fire is important to you. That’s why we gather it up into large fpiles, then do the minimal we’re legally required to technically avoid committing arson. For more information on how we and our trusted partners douse our pile of your stuff with gasoline while using our warehouses to hotbox cigars, weed and crack, see our 1000 page “not stealing and then getting high and catching your stuff on fire policy”.
dreamcompiler 4y ago
At Samsung, like at every other company, perception management is a top priority. And we will never understand why managing perceptions while ignoring reality always fails.

akersten 4y ago

> but in some cases, may have affected information such as name, contact and demographic information, date of birth, and That's all you need to steal someone's identity. Major reason why I never give any website my real birthday, and use a password manager to remember all the various "birthdays" I've been required to provide for no ostensible reason. If we wanted to hammer out a quick and effective privacy legislation, it would be: you need a demonstrable reason to ask for someone's birthday (e.g., legal reason to validate you're old enough to open a bank account or whatever), not "i want to send a happy birthday newsletter every year (and also sell it in a package to data brokers)"

capableweb 4y ago
> That's all you need to steal someone's identity I wish we could stop propagating the idea that it's possible to "steal someone's identity". No, you cannot take my identity from me, I am who I am, you are who you are. What you can do however, with those details, is tricking companies and committing fraud. But it should not be up to me to make sure companies are not being defrauded, the burden is on them to prevent that. Name, contact information and date of birth are so basic level of information, that if you can commit fraud with just those details, something is seriously wrong as the company you're performing the fraud against. Some countries even have those details publicly for you to find via public websites. So again, if that's all it takes, the company is doing something seriously wrong.
- dt3ft 4y ago
  In Sweden, this information is public.
  - sigmoid10 4y ago
    I have the feeling this is mostly a US thing, where a social security card with almost nil personal data is widely used for identification. In Europe you won't get very far with a birthday and a name - and you certainly won't get a credit card or anything close to it.

artificialLimbs 4y ago

"...and have engaged a leading outside cybersecurity firm and are coordinating with law enforcement." Sounds like "we got ransomeware'd".

theteapot 4y ago
The whole paragraph suggests it more strongly. Specifically why would you say "affected" rather than exposed / accessed?: > FAQ: Can you tell us more about what specifically happened? In late July 2022, an unauthorized third party acquired information from some of Samsung’s U.S. systems. On or around August 4, 2022, we determined through our ongoing investigation that personal information of certain customers was affected. We have taken action to secure the affected systems, and have engaged a leading outside cybersecurity firm and are coordinating with law enforcement.

marcodiego 4y ago

> may have affected information such as name, contact and demographic information, date of birth, and product registration information. No. No matter how safe of how carefully you take your security, a vendor should NOT keep these pieces of my private information with them.

ProAm 4y ago
Dont give it to them then,
- marcodiego 4y ago
  Yes. But it is becoming increasingly difficult with "smart" or "connected" devices. Sometimes you have to fill forms to access services or agree with EULA's with abusive terms. If you disagree with the terms, you become ostracized because everybody else from your circles accepted those terms and nobody is using your open-source/decentralized/federated network or services. You can't expect common people to be reasonable and spontaneously boycott abusive vendors. Most people are not educated enough for that. Among those who are, most don't care. We need laws to prevent this kind of abuse so vendors can't take advantage of people who are willing to share such information even if they are knowledgeable about its implications.
  - ProAm 4y ago
    We don't need laws just dont buy their products. You're asking a business to change it's business practices because you don't like them. Free market.
    - brewdad 4y ago
      It's becoming more and more difficult to do so. I can't remember the last time I bought a piece of electronics that didn't have a EULA. At this point, I half expect my breakfast cereal to come with a T&C.
      - 4y ago

mrtweetyhack 4y ago

morsch 4y ago

I would like to delete my Samsung account (which I was forced to create to access some feature of my phone). But I can't even access my profile because I'd need to accept some new user agreement which I won't do. I guess I could try sending them a letter.

hedora 4y ago

I love how they don't say how big the breach was, what systems were affected, or how to opt-out of them stealing your personal information and storing it on poorly secured servers: > Why does Samsung have my data? > We collect information necessary to help deliver the best experience possible with our products and services. We know how important privacy is to our customers, and we provide information about how we're planning to use customer data, in strict compliance with relevant privacy laws. You may visit the U.S. Privacy Policy section of our website for more details on how we may obtain data and for what purposes: https://www.samsung.com/us/account/privacy-policy/ https://www.samsung.com/us/account/privacy-policy/.

notsapiensatall 4y ago
From that privacy policy: > Information we may collect automatically includes information about >· your device, including MAC address, IP address, log information, device model, hardware model, IMEI number, serial number, subscription information, device settings, connections to other devices, mobile network operator, web browser characteristics, app usage information, sales code, access code, current software version, MNC, subscription information, and randomized, non-persistent and resettable device identifiers, such as Personalized Service ID (or PSID), and advertising IDs, including Google Ad ID; >· your use of the Services, including clickstream data, your interactions with the Services (such as the web pages you visit, search terms, and the apps, services and features you use, download, or purchase), the pages that lead or refer you to the Services, how you use the Services, and dates and times of use of the Services; and >· your use of third-party websites, apps and features that are connected to certain Services. So essentially, they're saying that they can log everything that you do on your device.
- dietr1ch 4y ago
  I don't even know why I got an email from them to my work email. AFAIK I've never used a samsung device at work and I have dedicated work devices.
  - nulbyte 4y ago

A4ET8a8uTh0 4y ago

This ship kinda sailed after Equifax data breach, but I wish we could make data a real liability ( as in, if you store it, you are on an actual legal hook for it ). 2017 settlement[1] was largely a joke if not an insult to all the affected individuals. The company still operates, no one went to jail and the company got a hard cap on potential claim from affected people. I don't know what the solution is exactly though ( I mean how to effect actual change instead of posting in this forum ). [1]https://www.ftc.gov/enforcement/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/refunds/equifax-data-breach-...

bee_rider 4y ago
I guess eventually everybody's data will be leaked (are we there yet?) and companies that would like to make loans will have to come up with some other way of verifying their customers. The credit system is a scam anyway. Oh wow thanks Equifax, you think I should be allowed to go up to my eyeballs in debt. What an honor, I'm flattered.

topicseed 4y ago

> may have affected information such as name, contact and demographic information, date of birth, and product registration information. What falls under "product registration information"?

ncphil 4y ago

Amateurs. Samsung's identity system was f*ed even before this. Only Lenovo/Motorola were worse. _Of course_ they got hacked: they were a big fat (in a purely metaphorical sense), stupid, target. The entire executive suite and board should be swept out and replaced. But that won't happen because those few have a lock on the majority of shares by either owning them outright or being golf partners with the like-minded idiot rest. Their main focus now, as always, is to deflect blame and preserve their positions. Does not inspire confidence in the future of anything. No wonder they can't get the simple things right, like providing clean water to Flint or Jackson. The clowns have taken over the bus and are driving it right over a cliff.

wqeraz 4y ago

Was this related to the Lapsus$ incident, or something else?

vardump 4y ago

Luckily I gave all fake information to Samsung. Because I expected this to happen.

hayst4ck 4y ago
From a post above: > your device, including MAC address, IP address, log information, device model, hardware model, IMEI number, serial number, subscription information, device settings, connections to other devices, mobile network operator, web browser characteristics, app usage information, sales code, access code, current software version, MNC, subscription information, and randomized, non-persistent and resettable device identifiers, such as Personalized Service ID (or PSID), and advertising IDs, including Google Ad ID; Regardless of how fake you think the information you gave them is, if you use your phone, there is more than enough information to attain a real identity and connect that to other identities. IMEI alone will uniquely identify your device, and therefore you, and it will be connected to a phone company that is probably willing to sell your data. https://arstechnica.com/tech-policy/2021/03/t-mobile-will-tell-advertisers-how-you-use-the-web-starting-next-month/ https://arstechnica.com/tech-policy/2021/03/t-mobile-will-te...
- vardump 4y ago
  I wonder what kind of information they got out of my TV. Well, obviously at least IP address. Maybe some viewing habits data. In which case they'll probably conclude I mostly like cartoons about ponies and talking, people rescuing dogs...
  - hayst4ck 4y ago
    TV's can probably scan your local network which means at the very minimum getting MAC addresses which can tell you the manufacturer and maybe more, of various devices on your network.
    - vardump 4y ago
      It can do that all it wants, won't be able to see any other devices on my network. Although it could scan for nearby wifi access points. Maybe also for bluetooth devices. It also got a microphone... Business idea: A service to strip microphones and antennas out of brand new TVs?

deleted 4y ago

[deleted]

shultays 4y ago

Samsung stores demographic information because why not. I wonder how much information is that

drcongo 4y ago

Blows my mind that anyone would buy a Samsung product given their data collection addiction.

parasti 4y ago

Oh, Samsung. I just went through the most insane account recovery process I've ever seen. Tried to register a Samsung account, but my email was already taken. Guess I must have had an account at some point. If you forget your password, you have to provide your name and date of birth to reset it. If you fail to enter the correct details many times, which I somehow did, eventually they will send you the recovery email anyway. When I received it, it was in a language I'd never seen. Then I discovered that it was actually somebody else's account from Indonesia that was using my email address without me ever knowing. So I now have a Samsung account that was someone else's but it was using my email so it was really mine?

ethbr0 4y ago
I've got a fairly common Gmail address as my primary. I get all kinds of account sign-ups, and also home purchase paperwork and sheriff's office employment offers, from multiple states. I used to feel bad, and spent a couple years trying to get in contact and correct whoever used my email. Now? Fuck em. If you use my email, it's my account. I just deleted "my" Roku account and unsubscribed to the services attached to it (required to delete an account). Me deleting "your" account is the least-abusive thing I could do if you sign up with my email address.
- aliqot 4y ago
  >Now? Fuck em. If you use my email, it's my account. I just deleted "my" Roku account and unsubscribed to the services attached to it (required to delete an account). >Me deleting "your" account is the least-abusive thing I could do if you sign up with my email address. This is illegal, CFAA of 1996. Them signing up with your email is a mistake, you deliberately modifying data that isn't your own because of that is illegal.
  - galangalalgol 4y ago
    Signing up for services using other people's email? Or canceling services attached to your iwn email?
  - 4y ago

SoftTalker 4y ago

Coincidentally (?) I got an unsolicited text message yesterday with my "Samsung account verification code."

AdmiralAsshat 4y ago

I feel stupid for ever giving Samsung this much info to begin with. But oh, they had such compelling reasons to do it. Like trading in my old phone to get a deep discount on a new one directly from Samsung, and bypassing all the carrier bullshit! Or locking down all of my devices, so that someone who steals my phone can't factory reset it without supplying my Samsung account credentials!

NoboruWataya 4y ago
When I saw this thread I went and checked my inbox to see if I had received an email telling me I was caught by this breach. I haven't, but what I do have are like five emails from my carrier in the last two weeks desperately trying to get me to upgrade to the latest Samsung phone. I have a Samsung from three years ago. I don't want to upgrade or replace it until it actually breaks, as constantly upgrading phones strikes me as wasteful. However, when I see this shit as well as all the Samsung apps they don't let you delete or disable from your phone, I am very tempted to just splash out on a Pixel to install GrapheneOS.
- SapporoChris 4y ago
  Many of the Samsung devices can be rooted. Example: https://forum.xda-developers.com/t/samsung-galaxy-s8-root-snapdragon-sampwnd.3659305/ https://forum.xda-developers.com/t/samsung-galaxy-s8-root-sn... The forum itself is a good place to start looking.
  - gzer0 4y ago
    I've had the opposite experience. S8, S9 Plus, S22+, all of them for some reason cannot unlock the bootloader. At this point I would recommend a Pixel of any variety. It's much much simpler to root and get GrapheneOS installed. Save yourself the headache (and the data leaks).

Mandatum 4y ago

Having reported a critical bounty, their incident response and disclosure process is a complete shitshow. Absolute mess of a company.

hijohnnylin 4y ago

Just got the email from Samsung saying I was part of the breach. At the end of this (extremely long and excuse-ridden) email they inform me that I'm entitled to a free credit check every year from credit reporting agencies. Can't we just fast forward to the part where they send me a $5 check for the class action settlement? They'd save a ton on legal fees.

WaitWaitWha 4y ago
I got the same. I find it insulting to offer a credit check. If I wanted, I would get 20 credit checks just this year. Credit checks are also (mostly) free. Everyone and their mother offers them. Why would that do me any good for checking? How does it remediate or mitigate the loss I have?
- autoexec 4y ago
  > Everyone and their mother offers them. I'm pretty sure the US government offers them for free, and anyone else doing it "for free" is only using at a means to collect and sell your personal information. Using some random site like getmemyfreecreditcheck.com or whatever is pretty much asking for your privacy to be violated.
  - selectodude 4y ago
    not that annualcreditreport.com feels any less random.
- revlolz 4y ago
  They aren't even offering one, it's worse than that. They are providing info how to use your one annual free credit check that is gov mandated. They are not offering anything other than notice.
baldeagle 4y ago
They are offering the free credit check provided by Uncle Sam- not even footing the bill for one of their own

aborsy 4y ago

How is it that security is a top priority when the company can’t correctly implement basic encryption? Samsung shipped so many millions of phones with insecure encryption: https://eprint.iacr.org/2022/208.pdf https://eprint.iacr.org/2022/208.pdf

jiggawatts 4y ago

Just here to remind everyone that Samsung televisions take screenshots at regular intervals of what you watch and sends this to be stored with the same level of “security”.

autoexec 4y ago
Roku does this too. > "Roughly twice per second, a Roku TV captures video “snapshots” in 4K resolution. These snapshots are scanned through a database of content and ads, which allows the exposure to be matched to what is airing. For example, if a streamer is watching an NFL football game and sees an ad for a hard seltzer, Roku’s ACR will know that the ad has appeared on the TV being watched at that time. In this way, the content on screen is automatically recognized, as the technology’s name indicates. The data then is paired with user profile data to link the account watching with the content they’re watching." (https://advertising.roku.com/resources/blog/insights-analysis/acr-the-future-of-tv-and-audience-data# https://advertising.roku.com/resources/blog/insights-analysi...!)
- cush 4y ago
  This is insane. I can't even imagine being at the meeting where this was proposed "Advertisers want to know when their ads are being viewed" - "We could work with advertisers to have them add some metadata to the output signal, and detect that on the client" "Nah, let's just record everything everyone watches, that way we can harvest the data and sell it to advertisers we haven't yet partnered with in the future" - "Yes, that sounds like a perfectly reasonable thing to do and couldn't possibly have any negative consequences. That is unless consumers have a problem with it..." "Who?"
  - autoexec 4y ago
    I can't believe they thought they needed multiple 4K screenshots every second. What a waste of bandwidth!
    - jiggawatts 4y ago

smm11 4y ago

I was just considering using an old iPhone instead of an S21. Decision made.

WaitWaitWha 4y ago

I requested to have all my info deleted by them. Let's see how long it takes. The email for my request is towards the bottom of this page: https://www.samsung.com/us/support/securityresponsecenter/ https://www.samsung.com/us/support/securityresponsecenter/ I am aware this does not fix the problem of the already stolen data, but it might make the data collection cost/benefit analysis in favor of discarding collection all-together. Maybe. Let me dream, would you?

jacooper 4y ago
According to their FAQ, the delete account button removes all of your data from their services.

rvz 4y ago

"We value your privacy" is just a buzzword for these companies.

TEP_Kim_Il_Sung 4y ago
Translation: "We value your privacy higher than we value you, because we get to sell it to anyone for top dollar."

derwiki 4y ago

California residents can request their data to be deleted here: https://www.samsung.com/us/privacy/ccpa/ https://www.samsung.com/us/privacy/ccpa/ I was surprised I even had a Samsung account so I can't think of any reason to keep one after this.

ev1 4y ago
I received this email to a CCPA "removed" email address.
brewdad 4y ago
Mine was linked to my college email. I have no idea how that got linked as I have been out of school for more than 20 years. I may have used it to get a "student" discount at some point in the recent past but who knows?

lizardactivist 4y ago

Other companies keep the lid on when it happens to them. Samsung has the decency to inform you quickly and clearly, gotta give them that.

fartcannon 4y ago
No, I won't give them anything. They don't need to take this information. They shouldn't have it. I think they and everyone else collecting data should be held far more accountable than they are for the damage they do when that data leaks.

2OEH8eoCRo0 4y ago

It's a red flag when a company says they are, "in strict compliance with relevant privacy laws." Complying with the law is the bare minimum.

jacooper 4y ago

My reaction to this news. Reset password > get into account > delete the account. A useless account that i shouldn't have used anyway. Pixel + Calyx FTW.

busymom0 4y ago

Can someone explain to me what the purpose of date of birth collection is? If it’s to verify the person is an adult, anyone can just lie. And why not just ask for age or age range instead?

libpcap 4y ago

Was the hacking state-sponsored?

hsbauauvhabzb 4y ago

> nformation such as name, contact and demographic information Nice way to gloss over how much ‘demographic information’ they actually collect…

gkhartman 4y ago

For anyone who stopped using Samsung products and wishes to delete their data: https://privacy.samsung.com/mydata/delete/request https://privacy.samsung.com/mydata/delete/request I couldn't find a way to close an account, but this is probably the next best thing.

zlltt 4y ago

as a Chinese dissident, if CCP got the leaked data and tracked to my identity via my Samsung device and account information. I may be put into CCP's jail for my internet speech. Samsung , your carelessness put many lives in danger!!

gU9x3u8XmQNG 4y ago

Tldr: whilst this incident is absolutely inappropriate; the big business behaviour will not change until users, too, recognise their accountability and responsibility. You purchased that product, accepted it’s usage terms, and supported this behaviour. Accept “some” responsibility in this outcome. — In regards to this security incident; users accepted the terms and conditions, which includes (usually in detail, or lack there of) their handling of the outcome, and impact to you. It’s a horrible situation. Im not saying it’s acceptable. however; I demonstrate so by not supporting (advocating, purchasing, etc) and accepting these outrageous terms. This is not isolated to Samsung… Our home is (wherever possible) a “Samsung” free zone, primarily inspired by their handling of the health incidents in their South Korean factories. Workers sick and dying, directly linked to the workplace. After years of persistent pressure from the families of these workers, the outcome was a payout and a typical “sorry we got caught” announcement. There has also been ongoing large-scale corruption in the head/leaders of the organisation, tied closely to South Korea in it’s entirety. It seems the outcome here is; “you’re really bad, but also really good… we’ll meet somewhere in the middle..”. Ps; am aware that Samsung parts are often included with other brand solutions. Hence “mostly” above. I proactively investigate, and avoid at all costs.

blagie 4y ago

Samsung's disclosure doesn't meet statutory requirements of either jurisdiction I reside in, and Samsung's collection of my information doesn't meet statutory requirements in one of them. I did not set up a Samsung account on my phone or log in, despite constant harassment, and now I got a notice saying my information was compromised.

prvc 4y ago

Does this apply to those who use Samsung devices without having made explicitly registered for an "account" with samsung.com? They must be made to reveal the extent to which keylogging and other surreptitious means of data collection are being used on their devices.