The Right to Privacy

A few days ago, a Hackfest reader/attendee contacted us to tell us a rather surprising story. He was apparently the victim of an "information leak" following a purchase he made over the summer. We found the story interesting enough to share it with you. Since the person does not wish to be identified, we removed and changed a few details from their message that could have identified them.

Here is their story:

"Over the holidays this year, something happened that I'd like to tell you about to get your take on it. A member of my family explained that she had been shopping a few weeks before that evening because she was interested in a product sold at that store.

The salesperson gives a sales pitch. This family member, who knows I had also bought that product and had problems with it, tells the salesperson: 'I like it, but I know someone who had problems and it took a long time to sort out.' This family member had no specific information about the kind of problems I'd had with the piece of hardware I bought several months earlier.

The salesperson, hoping to land a customer, then asks for my name. He wanted to show the potential buyer that the store had taken good care of me. Once I was identified, the salesperson, from what I'm told, pulls up my personal file and discloses all of my information to this family member.

So this person got access to information such as the date of my purchase, the full details of my problems, some information about the financing option I chose, the other items on the invoice, the exact times I filed complaints with the company and the specific reasons for those complaints.
I'm wondering what to do.

OK, the outcome isn't that serious, but this information was private. Not only was I a victim, but my personal information was used by this company in the hope of selling an item to a member of my family. No hacker involved, but still an information leak."

The rest of the text has been left out out of respect for privacy.

Just imagine how a social engineering attack could take advantage of this practice.

This whole story raises an important question for companies that are themselves customers of other companies:

Can we trust the suppliers we do business with?

This story forces us to take a hard look at that question, and our conclusion is that there are only two things that let a customer hope for the best. First, a solid contract between the parties that makes it easier to seek recourse in the event of an information leak. Second, choosing a supplier based not on the price it offers but on its quality and reputation. It follows that choosing a supplier, in a business context as much as a personal one, should inevitably involve checking that company's track record when it comes to information security.

Think about all the companies you do business with or have done business with. Do we really need to add anything?

The person who wrote this email tells us they are currently looking into recourse against the company in question. We can't wait to hear how this case turns out…