From our other sites
The story
German online PC parts retailers notebooksbilliger.de (NBB) and Mindfactory have both disclosed hacking incidents in quick succession. At NBB, in addition to addresses and contact details, IBANs (bank account numbers) may have been exposed — and although the breach itself was discovered in mid-October, customers weren’t notified until November. This sparked discussion in the German-language Lemmy community c/dach about concrete ways to protect personal information when shopping online, with debate over just how effective guest checkout and email “alias” features really are.
A week ago I got an email from notebooksbilliger.de (NBB) saying they’d detected unauthorized access to their computer systems. Apparently address and contact info, plus possibly IBANs (bank account numbers), may have leaked. The actual breach seems to have been discovered back in mid-October, and it wasn’t until early November that some affected customers were finally notified.
Then yesterday another email arrived — this time Mindfactory, another PC parts retailer, got hit. What may have leaked is contact/address data and encrypted passwords; no bank account or credit card info was included.
Source: pcgameshardware.de / original article here
What people said
I'll add one more: use guest checkout (no account registration) whenever possible.
Also, on slow days I go through old accounts and clean them up — deleting them or sending GDPR data access requests.
Nice, I'd forgotten about that one! Adding it to the list right now!
Also, if your provider already has an alias feature built in, why would you even need addy.io on top of that?
I use Posteo. But you only get 2 free aliases — anything beyond that costs extra. If you want a dedicated alias for every single account, the cost adds up fast.
Oh nice, addy.io can be self-hosted too. Sounds like a solid service — I was looking for exactly this to put a bit of distance between myself and iCloud.
Thanks.
Thanks!
Yeah, I'm in the exact same boat 😁
It's right there in the post 😉
>Abuse of leaked email addresses is basically all done by automated bots, and (for now) only a minority of bots bother stripping out the plus-addressing suffix.
Yeah, you can. I just haven't gotten around to trying it myself. It basically turns into "self-hosting your own mail server," which can go wrong in all sorts of ways (like your IP getting blacklisted for spam…). Do you feel confident enough to take that on?
I just found there's a Dockerized version now too — seems like it locks at least some of the complexity inside the container, though…
>But let me just say it: 80% of internet users are never going to keep up with this kind of countermeasure.
+19.x% (agreed)
>Even with guest checkout, your data obviously still ends up in the shop's database, so it can still be stolen.
True, but it only sits there as an "order-processing record," not as part of a "member database" — which makes it a less attractive target for hackers. After that it's basically just kept by the shipping department as a delivery address and by accounting for bookkeeping.
Background and Key Points of This Discussion
What’s being discussed here is practical know-how for protecting personal data. Under the GDPR (General Data Protection Regulation), German companies are obligated to notify customers when a breach is discovered, but in NBB’s case there appears to have been a gap of several weeks between the breach’s discovery (mid-October) and the notification (early November). Opinions in the thread diverged over how effective email “plus-addressing” (the feature that lets you append a suffix after a + in an address like [email protected]) really is. Comment 12 argues it’s effective since most abuse of leaked data is carried out by automated bots, many of which don’t yet strip out the “+” suffix, while comment 9 is skeptical, pointing out that ignoring everything after the “+” reveals the real address easily enough. It’s also easy to overlook that guest checkout doesn’t eliminate risk entirely, since the order record itself still stays in the shop’s system, and that alias-only services like addy.io are a different thing from fully self-hosting your own mail server — commenters valued them for offering the alias functionality without the operational burden.
※This article is a condensed, freely translated excerpt of a thread from the overseas forum Lemmy c/dach, “Dienstmeldung: Hacks bei deutschen Computer-Online-Shops {NBB und Mindfactory}.” Responsibility for the translation lies with this site’s editorial team.
Leave a Reply