American Cancer Society mailing list stolen?
Last year I made an on-line donation to the American Cancer Society in honor of a dearly departed friend. As I typically do, I created a unique e-mail address at one of my domains to register with the American Cancer Society. These address have some sort of descriptive text component followed by a number and sometimes some more random letters to the left of the ubiquitous “@” sign. They are quite unique and very unlikely to be guessed by traditional dictionary attacks.
So, imagine my surprise when, a few hours ago, I get an e-mail addressed to the unique address provided only to the American Cancer Society (ACS), which has nothing to do with ACS activities.
The mail message had a subject of “Just to her...” and was offering “Soft V__gra” (two letters blanked to avoid poorly designed spam filters), with a link to a web site presumably selling the offered goods.
The implication is that the American Cancer Society, a reputable organization, has had some part of all of its mailing lists hijacked by a spammer.
This could have happened in several different ways:
1) A PC which had my unique address on it at the ACS or an outside mailing house contracted by ACS, got infected with spyware which stole all the e-mail addresses and forwarded them to spammers (a vast majority of spyware and viruses are used for data collection these days).
2) Someone hacked into said PC(s) and outright stole the mailing list(s).
3) Someone with access to said PC(s) took the data and sold/gave it to someone else.
Regardless of which of the above methods caused my address (and thus very likely many others) to leak out to a spammer’s database.
Worse yet, I have just gone and done a search on my filtered spam archives, and find that I have been regularly receiving similar spam to that unique address as of July 17, 2005, so the theft of addresses likely occurred before then.
I count six spams - three for medication and three for pirated software.
Just goes to show that companies need to take the security of their mailing lists extremely seriously. I have reported this to the ACS, and urge anyone else who can trace the source of spam to an ACS list leakage please contact them.
Jake, on a news show (can’t remember now which one) this last weekend, they tracked down a spammer by his “sales id” number. Apperantly, these folks have sales ID’s with websites, and get commission on the memberships, drugs, etc. they sell on these spam sites. It was an interesting show, took them a long time to track down the individual who had sent the woman a particular spam.
I just usually delete delete delete, but I’m going to keep an eye out for spams such as the one you got and report them!
Post a comment