Incident: Data Breach at Play.com's Marketing Company Exposes Customer Information

Published Date: 2011-03-22

Postmortem Analysis
Timeline 1. The software failure incident at Play.com, where customer names and email addresses were stolen, occurred over the weekend as indicated by the first spams to unique emails starting on Sunday [4540]. 2. Published on 2011-03-22. 3. The software failure incident at Play.com likely occurred in March 2011.
System 1. Marketing email handling system [4540]
Responsible Organization 1. A third-party company handling Play.com's marketing emails was responsible for the software failure incident [4540].
Impacted Organization 1. Customers of Play.com were impacted by the software failure incident as their names and email addresses were stolen from a company handling Play.com's marketing [4540].
Software Causes 1. The software cause of the failure incident at Play.com was a breach in a third-party company that handles its marketing, leading to the theft of customer names and email addresses [4540].
Non-software Causes 1. Lack of clear communication and transparency from Play.com regarding the breach, including not providing enough information for customers to act on [4540]. 2. Inability for customers to delete credit card details from Play.com's site, even on request, potentially exposing sensitive information in case of a breach [4540].
Impacts 1. Customer names and email addresses were stolen, potentially putting them at risk of phishing attacks [4540]. 2. Lack of proactive communication from Play.com led to customer frustration and concerns about the security of their personal information [4540]. 3. Customers complained about the lack of information provided by Play.com regarding the breach, including the date of the incident [4540]. 4. Inability to delete credit card details from Play.com's site raised concerns about the security of payment information stored on the platform [4540]. 5. The incident highlighted the ongoing issue of database breaches for online sites, which can have significant financial and reputational consequences [4540].
Preventions 1. Implementing stricter security measures for third-party companies handling marketing activities to prevent unauthorized access to customer data [4540]. 2. Regular security audits and vulnerability assessments to identify and address potential weaknesses in the system [4540]. 3. Providing customers with the option to delete their credit card details from the website to reduce the risk of exposure in case of a breach [4540].
Fixes 1. Implementing stricter security measures for third-party companies handling marketing activities to prevent future breaches [4540]. 2. Providing more transparent and timely communication to customers regarding the incident, including the exact date of the breach and steps customers can take to protect themselves [4540]. 3. Allowing customers the option to delete their credit card details from the website for added security [4540].
References 1. Play.com (online retailer) 2. Luke Taylor (customer) 3. Moneysavingexpert.com (forum) 4. Lush (cosmetics company) 5. Guardian (news outlet) [#4540]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - Play.com experienced a breach where customer names and email addresses were stolen from a company handling its marketing, but credit card details were not affected [4540]. - The incident raised concerns about phishing attacks and customers receiving spam emails after the breach [4540]. - Play.com assured customers that their database is maintained on a secure internal server not connected to the internet, emphasizing that the breach occurred in a third-party company handling marketing emails, not on Play.com's own servers [4540]. (b) The software failure incident having happened again at multiple_organization: - The article mentions a previous incident involving the cosmetics company Lush being hacked, resulting in the theft of credit card details for customers who shopped there between October and January [4540]. - This reference to another company experiencing a similar breach suggests that database breaches of online sites are a recurring problem in the industry [4540].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase is evident in the breach of Play.com's marketing company, which resulted in the theft of customer names and email addresses. This breach occurred outside of Play.com, indicating a vulnerability introduced by the system development or procedures to operate the system [4540]. (b) The software failure incident related to the operation phase is highlighted by customers receiving spam emails to addresses provided only to Play.com, indicating a potential misuse or mishandling of customer data within the system's operation [4540].
Boundary (Internal/External) outside_system (a) within_system: The software failure incident at Play.com was related to a breach of customer names and email addresses due to a hack on a third-party company that handles Play.com's marketing emails. Play.com clarified that the issue occurred outside of their system, specifically mentioning that credit card details held at its main site were not affected. The breach could potentially lead to phishing attacks targeting customers. Play.com emphasized that they would never ask for sensitive information like passwords or credit card numbers via email. The incident highlighted concerns about the security of customer data and the inability to delete credit card details from Play.com's site [4540]. (b) outside_system: The breach at Play.com was attributed to a third-party company that handles the retailer's marketing emails. Play.com stated that the breach occurred outside of their system, indicating that the contributing factors originated externally. The incident raised concerns about the security practices of third-party service providers and the risks associated with sharing customer data with external entities [4540].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident at Play.com was primarily due to non-human actions. The breach occurred outside of Play.com, specifically at a third-party company that handles its marketing emails. This breach led to the theft of customer names and email addresses, potentially putting customers at risk of phishing attacks. Play.com emphasized that credit card details held at its main site were not affected, and they mentioned that their database is maintained on a secure internal server not connected to the internet, indicating that the breach did not directly involve their own servers [4540]. (b) Human actions also played a role in the aftermath of the software failure incident. Customers complained about the lack of proactive communication from Play.com regarding the breach, with some expressing concerns about the security of their credit card details stored on the site. Additionally, there were complaints about the inability to delete credit card details from the Play.com site upon request, which could potentially expose sensitive information if the payment database were breached. Customers sought more transparency and action from Play.com in response to the incident [4540].
Dimension (Hardware/Software) hardware (a) The software failure incident related to hardware: - The incident at Play.com involved a breach where customer names and email addresses were stolen from a company handling its marketing, indicating a security breach that could be attributed to hardware vulnerabilities [4540]. (b) The software failure incident related to software: - Play.com emphasized that the issue occurred outside of their own systems and that no other personal customer information was involved, suggesting that the failure was not directly related to their software but rather a third-party company handling marketing emails that was hacked [4540].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident reported in Article 4540 is malicious in nature. The incident involved a breach where names and email addresses of Play.com customers were stolen from a company handling its marketing. This breach could potentially put customers at risk of phishing attacks, where fake emails pretending to be from Play.com could be used to trick customers into providing sensitive information. The incident was described as a hack on a third-party company responsible for sending out marketing emails, indicating malicious intent to access and misuse customer data [4540].
Intent (Poor/Accidental Decisions) accidental_decisions (a) The software failure incident at Play.com was not due to poor decisions but rather a breach that occurred outside of Play.com's own servers. The breach involved the theft of customer names and email addresses from a third-party company that handles Play.com's marketing emails. Play.com emphasized that credit card details held at its main site were not affected, and they assured customers that their database is maintained on a secure internal server not connected to the internet [4540]. (b) The software failure incident at Play.com was more of an accidental decision or mistake rather than poor decisions. The breach that led to the theft of customer names and email addresses was not a result of Play.com's own servers being compromised but rather a breach that occurred outside of their control involving a third-party company handling marketing emails. Customers expressed concerns about the lack of proactive communication from Play.com regarding the breach and the inability to delete credit card details from the site, which could potentially expose sensitive information to criminals [4540].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the breach at Play.com where customer names and email addresses were stolen from a company handling its marketing. The incident highlights a lack of professional competence in ensuring the security of customer data, as the breach occurred outside of Play.com's main site, potentially exposing customers to phishing attacks [4540]. (b) The accidental aspect of the software failure incident is seen in the unauthorized access to customer data, leading to the exposure of names and email addresses. This breach was not intentional but occurred over the weekend, as indicated by the first spams appearing on Sunday, suggesting an accidental security lapse that allowed the hack to take place [4540].
Duration permanent (a) The software failure incident in the article seems to be more of a permanent nature. The breach of customer names and email addresses from the company handling Play.com's marketing is a serious issue that could have long-lasting consequences for the affected individuals. Additionally, the inability of customers to delete credit card details from Play.com's site raises concerns about the security and permanence of the breach [4540].
Behaviour other (a) crash: The incident reported in the article does not specifically mention a system crash where the system loses state and does not perform any of its intended functions [4540]. (b) omission: The incident does not describe a failure due to the system omitting to perform its intended functions at an instance(s) [4540]. (c) timing: The article does not mention a failure due to the system performing its intended functions correctly, but too late or too early [4540]. (d) value: The incident does not involve a failure due to the system performing its intended functions incorrectly [4540]. (e) byzantine: The incident does not involve a failure due to the system behaving erroneously with inconsistent responses and interactions [4540]. (f) other: The software failure incident described in the article is related to a data breach where customer names and email addresses were stolen from a company handling Play.com's marketing. This breach could potentially lead to phishing attacks targeting Play.com customers, exposing them to risks of providing sensitive information to malicious actors [4540].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) Property: People's material goods, money, or data was impacted due to the software failure. The software failure incident at Play.com involved a breach where customers' names and email addresses were stolen from a company handling the retailer's marketing. While credit card details held at the main site were reportedly not affected, the breach put customers at risk of phishing attacks where fake emails could be used to trick individuals into providing sensitive information such as passwords or credit card numbers [4540]. Customers expressed concerns about the lack of information provided by Play.com regarding the breach, including the date of the incident and the inability to delete credit card details from the site. This lack of transparency and control over personal data could potentially lead to financial harm if the payment database were breached, exposing many people's details to criminals [4540].
Domain sales, finance, knowledge (a) The failed system was related to the sales industry as it involved an online retailer, Play.com, warning its customers about a data breach where names and email addresses were stolen from a company handling its marketing [4540]. (h) The incident also has implications for the finance industry as credit card details were potentially at risk due to the breach, although Play.com stated that credit card details held at its main site were not affected [4540]. (m) The incident could also impact the knowledge industry as online security and data breaches are relevant to education and research in terms of safeguarding sensitive information and maintaining privacy [4540].

Sources

Back to List