3 ms·

I did a double take when I saw this because I've been in contact with Equifax recently because I started receiving SPAM form a non-existent email address that I

I did a double take when I saw this because I've been in contact with Equifax recently because I started receiving SPAM form a non-existent email address that I shared with them. I have a Catch-all address setup on my Domain so that I can give every site I interact with their own custom email address. In this case it was equifax.com@mydomain.com. Since the email address doesn't exist, and they're the only company I've shared it with, they're the only ones with a record of it's existence. When I emailed them asking if they'd had a security breach or if they were selling email addresses they responded saying they would opt me out of marking emails. When I responded with the context and header info of the emails I received and asked if this was in fact from them things turned. About an hour later I got a response, the tone had changed significantly and they indicated that the incident had been escalated to their security department and that they would be in contact with me as their investigation progressed. I can say this has been the best response to the dozens of emails I've sent to companies about the same issue. The worst was Best Buy whose response was something along the lines of "Eat Dk, we do what we want."

nwh 13y ago
Heh, same. The excuses I get from companies are hilarious. In my case they're just the domain, but encoded and obfuscated. The company will claim anything to get out of it, that my account was compromised, all the way to someone guessing it. Irritatingly, when I signed up for the utilities at my apartment I used a single address "utilities@domain.com" for simplicity. One of my three suppliers leaked my details with that address, and they all deny it. Took less than a week from moving in to getting penis pump advertisements at that address.
GFischer 13y ago
I worked for an Equifax subsidiary for a time, and I can vouch that at least there they took security very seriously, and always worked with the best practices. The downside was that changes were veery slow to implement :)
hnriot 13y ago
that's not exactly a difficult email address to guess, I would think that in this case (specifically this case) equifax would have a very good claim that it wasn't them that leaked it. If instead you had used a hash or something unguessable then you might have a case, but I could easily go and sign up to my favorite nigerian viagra supplier with all the usual suspects facebook@yourdomain.com, airbnb@yourdomain.com... and you'd go right on blaming the facebook, airbnb, etc.
- eropple 13y ago
  Agreed--this is why I append a few random characters to the end of my catchalls when I set them up. Not a hash or anything, but the likelihood of someone guessing a few characters blindly hit on the keyboard is low.
- cptskippy 13y ago
  This is a classic case of engineering a solution to a problem that doesn't exist. The first question you have to ask your self is for what reason would anyone choose to do that? Shits-and-giggles and malice against me personally are about the only legitimate reasons someone would do that. Spammers wouldn't want my dummy addresses in their list, and harvesters who sell emails to spammers wouldn't either because I could easily invalidate swaths of their lists by disabling my catch-all giving them a bad reputation. I mainly do this to see how my email address gets around. If and when I contact a company about my email address receiving SPAM, I don't name and shame in any public capacity. Its of little consequence how they respond because the damage is done, its not like they can undo the SPAM.
usefulcat 13y ago
I do the same thing (using unique email addresses) and over the years several such addresses have been aquired by spammers one way or another. Until recently, it was mainly smaller sites and businesses that this happened with. But I was quite surprised when I started getting spam at the unique address I gave to Dropbox.
- cptskippy 13y ago
  I'm always disappointed when I receive SPAM from large online companies like that. SPAM on non-profit emails or from small businesses that probably use Outlook are no surprise but large IT related companies are disappointed. I was pleasantly amused when I got an email from my congress man asking my specifically about my email address and wanting to know what was going on. We had a nice back and forth conversation about it and I had a greater appreciation for him as a result because I knew that a human was actually reading my emails. More than that, he was looking at the email address.
vinhboy 13y ago
Very interesting story. Do let us know how it turns out.

nwh 13y ago

Heh, same. The excuses I get from companies are hilarious. In my case they're just the domain, but encoded and obfuscated. The company will claim anything to get out of it, that my account was compromised, all the way to someone guessing it. Irritatingly, when I signed up for the utilities at my apartment I used a single address "utilities@domain.com" for simplicity. One of my three suppliers leaked my details with that address, and they all deny it. Took less than a week from moving in to getting penis pump advertisements at that address.

GFischer 13y ago

I worked for an Equifax subsidiary for a time, and I can vouch that at least there they took security very seriously, and always worked with the best practices. The downside was that changes were veery slow to implement :)

hnriot 13y ago

that's not exactly a difficult email address to guess, I would think that in this case (specifically this case) equifax would have a very good claim that it wasn't them that leaked it. If instead you had used a hash or something unguessable then you might have a case, but I could easily go and sign up to my favorite nigerian viagra supplier with all the usual suspects facebook@yourdomain.com, airbnb@yourdomain.com... and you'd go right on blaming the facebook, airbnb, etc.

eropple 13y ago
Agreed--this is why I append a few random characters to the end of my catchalls when I set them up. Not a hash or anything, but the likelihood of someone guessing a few characters blindly hit on the keyboard is low.
cptskippy 13y ago
This is a classic case of engineering a solution to a problem that doesn't exist. The first question you have to ask your self is for what reason would anyone choose to do that? Shits-and-giggles and malice against me personally are about the only legitimate reasons someone would do that. Spammers wouldn't want my dummy addresses in their list, and harvesters who sell emails to spammers wouldn't either because I could easily invalidate swaths of their lists by disabling my catch-all giving them a bad reputation. I mainly do this to see how my email address gets around. If and when I contact a company about my email address receiving SPAM, I don't name and shame in any public capacity. Its of little consequence how they respond because the damage is done, its not like they can undo the SPAM.

usefulcat 13y ago

I do the same thing (using unique email addresses) and over the years several such addresses have been aquired by spammers one way or another. Until recently, it was mainly smaller sites and businesses that this happened with. But I was quite surprised when I started getting spam at the unique address I gave to Dropbox.

cptskippy 13y ago
I'm always disappointed when I receive SPAM from large online companies like that. SPAM on non-profit emails or from small businesses that probably use Outlook are no surprise but large IT related companies are disappointed. I was pleasantly amused when I got an email from my congress man asking my specifically about my email address and wanting to know what was going on. We had a nice back and forth conversation about it and I had a greater appreciation for him as a result because I knew that a human was actually reading my emails. More than that, he was looking at the email address.

vinhboy 13y ago

Very interesting story. Do let us know how it turns out.