What should we do when your data is leaked online?

How long should we wait before publishing an article about a data leak?

  • Immediately

    Votes: 86 60.1%

  • Within 24 hours

    Votes: 23 16.1%

  • Within 48 hours

    Votes: 13 9.1%

  • When the company whose clients’ data was leaked approves

    Votes: 17 11.9%

  • Never

    Votes: 4 2.8%
  • Total voters
    143
MickeyD said:
It's the other companies involved that need to be informed to determine the impact of the leak on them and their customers (who are also customer of the hacked company).
Click to expand...

What other companies? :confused:
 
bwana said:
Do these third parties deserve to be informed before the client whose info was leaked?
Click to expand...

Nope, but they both should be informed before the general public...
 
The fact that RPM is posting a question like this means a lot to the community and the extended public. He's reviewing his procedures and asking for comment.

Good job rpm!
 
biometrics said:
What other companies? :confused:
Click to expand...

MD4Eva posted quite a bit about this.
He found some of his staff members' work email accounts in the leak, and he found that several customers used the same email address and password on the BoB website.
 
crackersa said:
The fact that RPM is posting a question like this means a lot to the community and the extended public. He's reviewing his procedures and asking for comment.

Good job rpm!
Click to expand...

This I agree with :)
 
Sinbad said:
MD4Eva posted quite a bit about this.
He found some of his staff members' work email accounts in the leak, and he found that several customers used the same email address and password on the BoB website.
Click to expand...

BoB has nothing to do with CW so it's irrelevant.
 
biometrics said:
BoB has nothing to do with CW so it's irrelevant.
Click to expand...

It's not irrelevant. BoB customer accounts were compromised. And possibly BoB staff accounts. As soon as this was discovered, BoB took steps to ensure that those accounts were not further compromised.
 
biometrics said:
So there could be 5,000 domains/companies involved. :wtf:
Click to expand...

Or more. If you used the same email address and password for your Ebay account... your facebook account... your paypal account ...
you get the picture.
 
Sinbad said:
Or more. If you used the same email address and password for your Ebay account... your facebook account... your paypal account ...
you get the picture.
Click to expand...

So now the media has to wait for 5,000 companies to be informed. No man!
 
biometrics said:
So now the media has to wait for 5,000 companies to be informed. No man!
Click to expand...

Never said that at all.

Note the calls for a standard procedure for this kind of thing to be disseminated to relevant companies ASAP...

And a responsible company that suffered a data leak would inform their customers immediately.
 
But rpm's question is a difficult one to give a clear answer on as there is so many factors involved. If said company takes 2 weeks to fix, should they list before then or wait till the fix? We all heard stories of companies ignoring exploits when brought to their attention and then there's people like Microsoft that takes months before they do a fix.

My personal opinion is to engage impacted company, give them time to review and asses how long it will take to correct. Come to an agreement on when the story will be published. I would go as far and say publish when he emails go out about password resets. Coordinate the comms so the public is aware what happened and assist in affected company in communicating how to resolve the issue.

It's a impromptu partnership and everyone will be glad of the outcome.

And if a company doesn't want to play ball...feck them and watch them burn

:evil:
 
crackersa said:
But rpm's question is a difficult one to give a clear answer on as there is so many factors involved. If said company takes 2 weeks to fix, should they list before then or wait till the fix? We all heard stories of companies ignoring exploits when brought to their attention and then there's people like Microsoft that takes months before they do a fix.

My personal opinion is to engage impacted company, give them time to review and asses how long it will take to correct. Come to an agreement on when the story will be published. I would go as far and say publish when he emails go out about password resets. Coordinate the comms so the public is aware what happened and assist in affected company in communicating how to resolve the issue.

It's a impromptu partnership and everyone will be glad of the outcome.

And if a company doesn't want to play ball...feck them and watch them burn

:evil:
Click to expand...

I'd add rep for this post but I already whored it out in TK

Nicely said.
 
Sinbad said:
Or more. If you used the same email address and password for your Ebay account... your facebook account... your paypal account ...
you get the picture.
Click to expand...

Then surely the one person who has access to all those, the user, should be informed, in the clearest language possible, asap?
 
bwana said:
Then surely the one person who has access to all those, the user, should be informed, in the clearest language possible, asap?
Click to expand...

Would a personal message (SMS, Whatsapp, email, etc) directly to the customer not be quicker than an article on mybb, IT News, Techcentral, etc?
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X