Numerous sites leak user emails to advertising, analytics services

guest · Apr 29, 2020

Numerous sites leak user emails to advertising, analytics services
Breaches have been found on websites including Wish.com, JetBlue.com, Quibi.com, WashingtonPost.com, NGPVan.com, ...
April 29, 2020
https://www.bleepingcomputer.com/ne...ser-emails-to-advertising-analytics-services/

Multiple online services and products are leaking email data belonging to their users to third-party advertising and analytics companies, shows a recent research published today.

Websites mentioned in the report include Quibi.com, JetBlue.com, KongHQ.com, NGPVan.com, Mailchimp’s Mandrill.com, WashingtonPost.com, Wish.com. Between them, there are hundreds of millions of emails.
Free email addresses
These are not the only ones affected, though; an unknown number is currently leaking this type of data, says Zach Edwards from Victory Medium, a company offering web analytics and testing systems. In some cases, email data is leaked to dozens of such service.

On the list of parties receiving email information are major services providing analytics, advertising, tracking, optimization, and marketing instruments, like Google, Facebook, Twitter, Mixpanel, Wistia, Pardot, CrazyEgg, New Relic, DrawBridge.
Click to expand...

The details are passed in request headers through a web browser and can be anything from a page the user visited to their location, type of device used, or other forms of information: fingerprinting, cookies, URL query string or parameters.

Edwards calls the leaks data breaches, since email addresses count as personal information and is, therefore, protected through regulations and laws in many countries.
Creating new account? URL gets your email
In his report today, the researcher provides several scenarios that leaked users’ emails to various third-party services through JavaScript code that collects data from a website.
Click to expand...

Newsletter unsubscribes share your email too
Another organization tested by the researcher is the democratic data broker NGPVAn.com/EveryAction.com and their clients. They provide CRM and marketing services for political and nonprofit customers.

The leak in this case occurs during the unsubscribe process, when the user email is added at the end of the URL. This has been happening for several years, the researcher says.
Another big name on the list is Washington Post, which encoded user emails in base64 ad leaked them to service providers when users unsubscribed from the newsletter service for “This Week in Ideas.“
Click to expand...

The 2020 URL Querystring Data Leaks — Millions of User Emails Leaking from Popular Websites to Advertising & Analytics Companies

Most popular websites on the internet are using 3rd party analytics and advertising Javascript code — and depending on how a website sets up their marketing systems, typically email systems and new user signup flows, the user emails can accidentally and/or purposefully leak to companies across the global data supply chain.

All organizations included in this research leaking user emails should publicly post the list of all their historical advertising and analytics vendors who could have received the user emails while their respective breaches were active.
One important trend to notice is how often Google Analytics, Google’s DoubleClick, Facebook, and Twitter are ingesting the user emails — [...]

In this research, there are also “red flag organizations” who have ingested user emails that are small or relatively unknown organizations, yet likely receiving huge amounts of user emails in their request logs.
Click to expand...

guest · May 1, 2020

Quibi Improperly Shared User Email Addresses With Third-Party Ad Firms, Researcher Says
April 29, 2020
https://variety.com/2020/digital/news/quibi-emails-leaked-third-party-privacy-1234593876/

Quibi shared the email addresses of users who signed up for the service with third-party advertising and tracking companies through plain-text web links, a new study claims.

In a statement, Quibi said it addressed the issue “immediately” once the company was notified April 28. “Data protection is essential to Quibi and the security of user information is of the highest priority,” it said.
Quibi reconfigured its email verification process so that no user email addresses will be sent to third-party vendors in that way, according to the company.

Other companies also found to be improperly sharing users’ email addresses with third-party marketing firms included the Washington Post, JetBlue, Mailchimp and ecommerce platform Wish.com, according to the report. In some cases, the data sharing has been in place for several years, Edwards claimed.
Click to expand...

Edwards singled out Quibi’s “user data breach” as “one of the most egregious in this research, because they are a new and extremely well-funded organization.”
In addition, he pointed out, Quibi launched well after two major privacy regulations — Europe’s GDPR and the California Consumer Privacy Act (CCPA) — went into effect; both of those laws require companies to notify users if their email or other private info is being shared.

“In 2020, no new technology organizations should be launching that leaks all new user-confirmed emails to advertising and analytics companies — yet that’s what Quibi apparently decided to do,” Edwards wrote.
Quibi’s privacy policy, dated April 6, does disclose that, “We may share personal information with third-party service providers for them to facilitate services they provide to us,” including such services as “personalized advertising, ad measurement and verification.”
Click to expand...

Log in or Sign up

Numerous sites leak user emails to advertising, analytics services

guest Guest

guest Guest

Log in or Sign up

Numerous sites leak user emails to advertising, analytics services

guest Guest

guest Guest

Useful Searches