3 ms·

"The data involved consisted only of email addresses and information already visible on public SoundCloud profiles". So they've scraped public data. Why care?

by djee 8mo ago

forgotaccount3 8mo ago
Maybe the two public data points weren't connected before? I don't use SoundCloud, but if profiles didn't have contact information like Email Address on them then it could be meaningful to now connect those two dots. Like, 'Hey look, Person A, who is known to use email address X, kept Lost Prophets as one of their liked artists even after 2013!'
- refulgentis 8mo ago
  You are 100% correct based on article. Not good that you're gray, and your parent of "who cares it was already available and scraped" is the top comment.
- cj 8mo ago
  But, why care? (Yes, we can “care” that there was a leak - but… why worry? what new risk exists today that didn’t yesterday?) The data in the leak (other than follower count, etc) was already available for purchase from Zoominfo, 8sense, or a variety of other data brokers or other legal marketplaces for PII. I suppose the risk now is that the data is freely available and no longer behind a data broker’s paywall?
  - refulgentis 8mo ago
    I'm confused, where were scrapers/data brokers/Zoominfo etc. were getting email addresses for SoundCloud accounts?
    - cj 8mo ago
      They don’t. I’m confused why that info is valuable.
      - saaaaaam 8mo ago
        People pitching scammy “I can make you famous” services to aspiring musicians. Happens all the time, there’s a whole industry dedicated to it.
      - refulgentis 8mo ago
        Let's say you have a $SOCIETAL_TABOO streak and let it out via a soundcloud account that isn't identifiable as you without your email. Now it is. Now I can blackmail you or haunt you. (I'm sure there's other examples, tl;dr people are deanonymized, there are uncountable reasons why people choose anonymity) > The data in the leak (other than follower count, etc) was already available for purchase from Zoominfo, 8sense, or a variety of other data brokers or other legal marketplaces for PII. ?
  - direwolf20 8mo ago
    Isn't that a huge GDPR violation?
- neom 8mo ago
  Yeah or this: https://news.ycombinator.com/item?id=26386418 https://news.ycombinator.com/item?id=26386418 SoundCloud is a weird place, people in entertainment have certain strong incentives. They figured out who I am, figured out all the email addresses I have, jacked the account attached to my SoundCloud, stole my account. I still to this day, don't know how they pwned my email (tfa was on but it didn't trigger suspicious activity it let them login without triggering it, no clue how they got the password either and the password is secure enough that it's too hard to brute force, and it's not in a pwned db). Based on what was in my soundcloud inbox when I got access again, someone paid a fair amount to have this done... and now I have to go change my email again I suppose.
  - direwolf20 8mo ago
    Organized crime stealing usernames was apparently a thing for a few years back there, interesting it wasn't limited to Twitter.
gnabgib 8mo ago
Hackers stole information of 29.8M accounts (~20% of users). SoundCloud is downplaying the data beyond email address as "publicly available", but the data wasn't scraped. "Profile statistics" aren't public either. Their main response[0], seems to focus on passwords and payment details being the only risky data. They even imply email addresses are public. > no sensitive data was taken in the incident.The data involved consisted only of email addresses and information already visible on public SoundCloud profiles (not financial or password data) [0]: https://soundcloud.com/playbook-articles/protecting-our-users-and-our-service https://soundcloud.com/playbook-articles/protecting-our-user...
- idiotsecant 8mo ago
  If the email addresses were visible on public profile pages in what sense are they not public?
  - hamdingers 8mo ago
    Email addresses are not visible on public soundcloud profiles. You can test this yourself. I read the statement to be "emails plus public information"
richrichardsson 8mo ago
> email addresses Aren't on public SoundCloud profiles.

"The data involved consisted only of email addresses and information already visible on public SoundCloud profiles". So they've scraped public data. Why care?

by djee 8mo ago

"The data involved consisted only of email addresses and information already visible on public SoundCloud profiles". So they've scraped public data. Why care?

forgotaccount3 8mo ago

Maybe the two public data points weren't connected before? I don't use SoundCloud, but if profiles didn't have contact information like Email Address on them then it could be meaningful to now connect those two dots. Like, 'Hey look, Person A, who is known to use email address X, kept Lost Prophets as one of their liked artists even after 2013!'

refulgentis 8mo ago
You are 100% correct based on article. Not good that you're gray, and your parent of "who cares it was already available and scraped" is the top comment.
cj 8mo ago
But, why care? (Yes, we can “care” that there was a leak - but… why worry? what new risk exists today that didn’t yesterday?) The data in the leak (other than follower count, etc) was already available for purchase from Zoominfo, 8sense, or a variety of other data brokers or other legal marketplaces for PII. I suppose the risk now is that the data is freely available and no longer behind a data broker’s paywall?
- refulgentis 8mo ago
  I'm confused, where were scrapers/data brokers/Zoominfo etc. were getting email addresses for SoundCloud accounts?
  - cj 8mo ago
    They don’t. I’m confused why that info is valuable.
    - saaaaaam 8mo ago
      People pitching scammy “I can make you famous” services to aspiring musicians. Happens all the time, there’s a whole industry dedicated to it.
    - refulgentis 8mo ago
      Let's say you have a $SOCIETAL_TABOO streak and let it out via a soundcloud account that isn't identifiable as you without your email. Now it is. Now I can blackmail you or haunt you. (I'm sure there's other examples, tl;dr people are deanonymized, there are uncountable reasons why people choose anonymity) > The data in the leak (other than follower count, etc) was already available for purchase from Zoominfo, 8sense, or a variety of other data brokers or other legal marketplaces for PII. ?
- direwolf20 8mo ago
  Isn't that a huge GDPR violation?
neom 8mo ago
Yeah or this: https://news.ycombinator.com/item?id=26386418 https://news.ycombinator.com/item?id=26386418 SoundCloud is a weird place, people in entertainment have certain strong incentives. They figured out who I am, figured out all the email addresses I have, jacked the account attached to my SoundCloud, stole my account. I still to this day, don't know how they pwned my email (tfa was on but it didn't trigger suspicious activity it let them login without triggering it, no clue how they got the password either and the password is secure enough that it's too hard to brute force, and it's not in a pwned db). Based on what was in my soundcloud inbox when I got access again, someone paid a fair amount to have this done... and now I have to go change my email again I suppose.
- direwolf20 8mo ago
  Organized crime stealing usernames was apparently a thing for a few years back there, interesting it wasn't limited to Twitter.

gnabgib 8mo ago

Hackers stole information of 29.8M accounts (~20% of users). SoundCloud is downplaying the data beyond email address as "publicly available", but the data wasn't scraped. "Profile statistics" aren't public either. Their main response[0], seems to focus on passwords and payment details being the only risky data. They even imply email addresses are public. > no sensitive data was taken in the incident.The data involved consisted only of email addresses and information already visible on public SoundCloud profiles (not financial or password data) [0]: https://soundcloud.com/playbook-articles/protecting-our-users-and-our-service https://soundcloud.com/playbook-articles/protecting-our-user...

idiotsecant 8mo ago
If the email addresses were visible on public profile pages in what sense are they not public?
- hamdingers 8mo ago
  Email addresses are not visible on public soundcloud profiles. You can test this yourself. I read the statement to be "emails plus public information"

richrichardsson 8mo ago

> email addresses Aren't on public SoundCloud profiles.