Privacy breaches because of mistakenly sending of emails via CC instead of BCC

guest · Aug 6, 2020

Metrolinx investigating privacy breach after 2K email addresses of fined riders revealed
August 5, 2020
https://globalnews.ca/news/7252617/metrolinx-compliance-services-emails-privacy-breach/

Metrolinx, the transit organization that oversees GO Transit and UP Express, officials say they are investigating a privacy breach that saw more than 2,000 email addresses of riders who were fined publicly revealed in a mass email.

Staff were attempting to get feedback from riders on their interactions with the compliance services office, which processes tickets, fines and handles ticket disputes.

“If you participate in this survey, your responses will be kept anonymous and confidential. Answers will be reviewed only in aggregate to help us improve our services,” a copy of the email message provided to Global News said in part.
Click to expand...

However, the email addresses were seemingly put in a public email address field versus the blind carbon copy field, allowing fellow riders to potentially identify who else was ticketed if the email address contained a name.

She said Metrolinx contacted Ontario’s privacy commissioner to ask for guidance on handling the privacy breach, and said they were told to encourage those on the email to not reply all and to delete the message.
Click to expand...

shmu26 · Aug 7, 2020

I make this mistake sometimes myself, I put receipients in cc instead of bcc.
If anyone has a suggestion how to avoid this mistake, I am all ears!

RioHN · Aug 7, 2020

It depends on the email system you use and whether you have individual or business accounts. As an example Office365 for business allows you to create mailflow rules which can be used to force BCC when emailing chosen distribution lists, or when emailing from chosen email accounts in your organisation.

guest · Oct 22, 2020

'Adding insult to injury': another Dfat bungle reveals identities of Australians stranded overseas
Exclusive: data breach involves email from Australian embassy in Paris to citizens who registered to return home
October 22, 2020
https://www.theguardian.com/austral...s-identities-of-australians-stranded-overseas

The foreign affairs department has again revealed the identities of Australians stranded overseas by adding their email addresses into the wrong field – the third data breach in as many months.

In the embassy’s email, seen by Guardian Australia, the contact details of at least 15 Australian citizens appear in the Cc section, above an email announcing the embassy was accepting expressions of interest for repatriation flights into Perth.
After Guardian Australia contacted Dfat, the department attempted to recall the email and asked recipients who still had access to delete it.

“We are undertaking an assessment of this incident and are reviewing our internal processes to ensure such mistakes do not happen again,” Dfat’s follow-up email to recipients said.
Click to expand...

Palancar · Oct 25, 2020

I would love to see email providers require a 2-3 digit little "approval PIN" before allowing a cc on my emails. Nothing serious security wise just a reminder flag so you would stop making a stupid/careless move on a transmission. At work we had an Admin Asst send a cc to over 500 folks instead of a bcc. It cost me and others many hours putting the bad PR fire out. It was a disaster for us. That was years ago but I still feel the pain.

guest · Nov 17, 2020

Coil payments platform leaks user emails in 'Privacy Policy' update
November 17, 2020
https://www.bleepingcomputer.com/ne...m-leaks-user-emails-in-privacy-policy-update/

Coil has accidentally exposed some of its users' email addresses in a mass email announcement sent out today.

Coil is a micropayments platform, similar to Patreon (but not quite) that is used by writers and popular blogging sites to monetize content.
Ironically, the mishap happened within an email announcement related to the company's Privacy Policy updates.
At least 1,000 emails disclosed in mass announcement
In an email announcement sent out a few hours ago, as observed by BleepingComputer, the company had notified content creators of upcoming changes to its terms and privacy policy.

It is likely other users saw a different set of email addresses listed in the To or CC fields, assuming the mass announcement was emailed in batches of 1,000.
Click to expand...

CEO issues an apology
Roughly two hours after the mass email had been sent, Stefan Thomas, Coil's Founder and CEO issued an apology—this time without CC'ing an additional thousand users.

"Earlier this evening we sent you an email updating you on changes to our Terms & Privacy Policy. Unfortunately, due to a human error related to how we interface with our mailing list provider, a number of users' email addresses were populated alongside yours," said Thomas.
Click to expand...

Erroneous bulk email notifications from tech companies seem to have become frequent occurrences.

Last week, Rakuten had erroneously emailed multiple customers, stating the customers had earned cashback, only to recall their words later.
In October, a Home Depot email blunder had exposed hundreds of customer orders and personal information to strangers CC'd in emails.
Click to expand...

guest · Nov 26, 2020

Bristol City Council Data Breach Revealed Names Of Disabled Children
November 25, 2020
https://www.silicon.co.uk/e-regulat...-city-council-breach-disabled-children-349140

Bristol City Council has suffered a damaging data breach and the Information Commissioner’s Office (ICO) has been informed.

Earlier this week, the council sent out a mass email to hundreds of people, as part of a consultation asking for people to take part in a survey about a new support service.
The only problem was the names and email addresses of hundreds of children who are either disabled or have special educational needs, was visible to all recipients.

The email has been seen by the BBC, which reported that the email had been sent by the disabled children and specialist services department of the council on Monday morning, 23 November.
Click to expand...

And it seems that council has realised the mistake, which could potential involve a hefty fine from the ICO.

“We are aware a breach of the General Data Protection Regulation (GDPR) has occurred and we have been in contact with those affected and have apologised,” a Bristol City Council spokesman told the BCC.
The problem stems from the fact that the email’s recipient list was not hidden on the mass email.
The council has reportedly apologised to parents and asked everyone who received the email to delete it.
Click to expand...

guest · Dec 2, 2020

Australia’s largest cryptocurrency exchange accidentally exposed the names and emails of 270,000 customers
December 2, 2020
https://www.businessinsider.com.au/btc-market-cryptocurrency-privacy-breach-2020-12

One of the main selling points of cryptocurrencies is that they are designed to offer their users privacy or even complete anonymity. But not even the cleverest creators can completely thwart human error.

Early on Tuesday morning, an Australian cryptocurrency exchange that bills itself as the largest in the country inadvertently exposed more than 270,000 of its members names and email addresses.
Users posted to social platforms like Twitter and Reddit to complain about the breach.

BTC Markets Tether Listing & Spark token Update. Everyone's name and email address pic.twitter.com/x2U4FnZMoR
— Stevosxrp.crypto (@Stevo36787477) December 1, 2020
Click to expand...

The company stressed that the breach did not affect their exchange, nor were there passwords exposed in the breach. The company’s CEO Caroline Bowler said in a tweet that all of its customers were affected.

In the process of sending out correspondence, the company’s customers’ names and emails were included in the ‘to’ section of emails, rather than being blind carbon copied or individually addressed.
The emails were batch limited to 1000 recipients, meaning that each individual only received an email with the details of up to 999 other customers rather than the full list.
Click to expand...

guest · Aug 11, 2021

Work and Income privacy breach due to email mistake
August 10, 2021
https://www.stuff.co.nz/business/126016164/work-and-income-privacy-breach-due-to-email-mistake

Private email addresses of 103 beneficiaries have been made public due to a mistake by a Work and Income caseworker.

They were carbon copied (CC) into an email promoting free fruit and nuts from the Christchurch City Council, rather than blind carbon copied (BCC), which would have concealed them from each other.
One of the addresses was Ben Brown’s, who said he felt humiliated by the privacy breach.

“I feel quite emotional actually. At the end of the day we have no idea who has got their hands on these emails. You can do a lot of things with an email, especially if you know how to hack,” Brown said.
Click to expand...

Kay Read, group general manager client service delivery, at the Ministry of Social Development, confirmed 103 beneficiaries were sent emails with all the email addresses visible to those who were copied in. No other personal client details were shared.

Martin Cocker, chief executive of Netsafe, said this type of privacy breach was an easy mistake to make.

“Everybody that has ever used email has probably sent something they meant to blind carbon copy through the carbon copy function. So we all know it is not entirely uncommon to do that. But people who are transacting sensitive information need to be cautious about that.”
Click to expand...

guest · Oct 10, 2021

350 Qld border-pass applicants caught in police privacy breach
October 10, 2021
https://www.theage.com.au/national/...in-police-privacy-breach-20211010-p58yp8.html

The Queensland Police Service has again been caught up in a privacy breach, this time involving the email addresses of more than 350 people – including AFP, Defence and Queensland Health staff –trying to return to Queensland.

The border-pass applicants were among thousands of people seeking to enter Queensland from interstate COVID-19 hotspots under tight border restrictions.
Click to expand...

But while sending one batch of invitations on Saturday, Queensland Police inadvertently revealed the emails of more than 350 invitees to each other in a group email that failed to use the blind carbon copy, or BCC, function, which conceals a person’s email address to other recipients.
Click to expand...

The breach is similar to one in September last year involving Australians stuck overseas who were contacted by the Department of Foreign Affairs and Trade [...]

In a statement, a Queensland Police spokesman said when the service became aware of the mistake on Saturday afternoon, it recalled the group email and deleted unread emails.
He said early investigations suggest “human error” was behind the bungle, and he stressed that “no other personal information” was revealed.
Click to expand...

Rasheed187 · Oct 12, 2021

Palancar said: ↑

I would love to see email providers require a 2-3 digit little "approval PIN" before allowing a cc on my emails. Nothing serious security wise just a reminder flag so you would stop making a stupid/careless move on a transmission. At work we had an Admin Asst send a cc to over 500 folks instead of a bcc. It cost me and others many hours putting the bad PR fire out. It was a disaster for us. That was years ago but I still feel the pain.
Click to expand...

Yes, it's crazy. My mother recently received an email from the hospital with all of the recipient's email addresses that were visible, so either she was an idiot who had never heard of BCC or she made a mistake.

Rasheed187 · Oct 13, 2021

BTW, to clarify. It was not my mother who was the idiot, but the hospital employee who sent the email and happened to be female.

guest · Oct 20, 2021

NHS Digital exposes hundreds of email addresses after BCC blunder copies in entire invite list to 'Let's talk cyber' event
October 20, 2021
https://www.theregister.com/2021/10/20/bcc_fail_nhs_digital/

NHS Digital has scored a classic Mail All own-goal by dispatching not one, not two, not three, but four emails concerning an infosec breakfast briefing, each time copying the entirety of the invite list in on the messages.

The first email sent yesterday morning thanked participants for "registering for NHS Digital's Full Digital Breakfast: Let's talk cyber, scheduled for Thursday 21 October 2021, 8:00-9:00am."
Apparently Neil Bennett, CISO at NHS Digital, and Phil Huggins, National CISO at NHS X, "along with guest speakers, will have a conversation about the ongoing protection and how an increasingly digitised world means we must be super vigilant and cyber secure, where cyber hygiene is essential in protecting patients."
Click to expand...

According to sources caught up in the email chain, NHS Digital were sending the emails in an attempt to change the invite details. The fourth was a cancellation "again with every single person copied in," one healthcare techie told us.

"They have subsequently put an email out to a BCC list that just reiterates the meeting is on but does not acknowledge the data breach.
"Oh and it's still doing the rounds as some people have done the usual 'Reply All', which is a frustration to anyone who didn't want their emails sharing or their inboxes clogging."
Click to expand...

guest · Oct 25, 2021

HIV Scotland fined £10,000 for BCC email blunder identifying names of virus-carriers' patient-advocates
October 25, 2021
https://www.theregister.com/2021/10/25/hiv_scotland_email_fail/

The United Kingdom's data watchdog is calling on organisations to review their "bulk email practices" after a BCC blunder by HIV Scotland incurred a £10,000 fine for breaking data protection regulations.

The case pertains to an email that was sent to 105 individuals on the Community Advisory Network (CAN) list, which is made up of patient-advocates "from across Scotland to represent the full diversity of people living with HIV". In the offending chain, all of the email addresses were visible to all recipients and some 65 were people identified by name.
Click to expand...

The Information Commissioner's Office (ICO), which investigated the February 2020 email event, said that from the personal information exposed, assumptions could be made about the people's HIV status or risk.

HIV Scotland was penalised with a £10,000 fine under section 155 of the Data Protection Act 2018. It fully migrated all of its lists to MailChimp in late February 2020 and checked its SharePoint server to ensure no personal data was stored separately from the secure mailing lists. Staff have since undertaken online training.

"The Commissioner takes the view from her investigation that this breach occurred primarily as a result of serious deficiencies in HIV Scotland's technical and organisational measures," the ICO concluded.
Click to expand...

imdb · Oct 7, 2022

Game company 2K on Thursday warned users to remain on the lookout for suspicious activity across their accounts following a breach last month that allowed a threat actor to obtain email addresses, names, and other sensitive information provided to 2K's support team.

The breach occurred on September 19, when the threat actor illegally obtained system credentials belonging to a vendor 2K uses to run its help desk platform.
...
On Thursday, after an outside party completed a forensic investigation, 2K sent an unknown number of users an email warning them that the threat actor was able to obtain some of the personal information they supplied to help desk personnel.
Click to expand...

2K warns users their info has been stolen following breach of its help desk by Dan Goodin

Log in or Sign up

Privacy breaches because of mistakenly sending of emails via CC instead of BCC

guest Guest

shmu26 Registered Member

RioHN Registered Member

guest Guest

Palancar Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Rasheed187 Registered Member

Rasheed187 Registered Member

guest Guest

guest Guest

imdb Registered Member

Log in or Sign up

Privacy breaches because of mistakenly sending of emails via CC instead of BCC

guest Guest

shmu26 Registered Member

RioHN Registered Member

guest Guest

Palancar Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Rasheed187 Registered Member

Rasheed187 Registered Member

guest Guest

guest Guest

imdb Registered Member

Useful Searches