Target "acquires data"

It was our priority to inform as many guests as quickly as possible. Relevant emails were pulled from a variety of sources.
@AskTarget

It looks like Target is mailing data that was never given to them in an effort to “inform” customers of the data breach.
There are lots of problems with how Target is managing this email campaign. The first is in delivery. They’re hitting thousands of traps on one small part of dedicated traps at Spamhaus. They’re also blocked at Spamcop and have hit over 70 traps in the last 24 hours. Senderscore shows the IP has almost 100 trap hits as well, and a high unknown user rate.
On top of that, when we called the number Target gave us in the email, the phone rep told us that the address the mail was sent to was not in the Target database. Thus, she concluded, that the mail was actually a phishing email. Now, I don’t believe it was a phish, I think it was legitimate. But you can’t have your front line folks answering the phone telling people the mail you sent out was phishing.
There are a number of other problems with this mailing, that we’re still cataloging and will report on next week.
Overall, though, the email handling of this notification was a total failure on Target’s part.

Related Posts

Handling replies to bulk mail

This week’s Wednesday question comes from Ryan W.

I’ve been noticing a few e-mail accounts who reply to our e-mail sends with spammy type replies such as, “hey this is intense…..(link)” what do you think should we be removing those e-mails from our mailing?

Read More

Harvesting and forging email addresses

For the contact address on our website, Steve has set up a rotating set of addresses. This is to minimize the amount of spam we have to deal with coming from address harvesters. This has worked quite well. In fact it works so well I didn’t expect that publishing an email address for taking reader questions would generate a lot of spam.
Boy, was I wrong. That address has been on the website less than a month and I’m already getting lots of spam to it. Most of it is business related spam, but there’s a couple things that make me think that someone has been signing that address up to mailing lists.
One is the confirmation email I received from Yelp. I don’t actually believe Yelp harvested my address and tried to create me an email account. I was happy when I got the first mail from Yelp. It said “click here to confirm your account.” Yay! Yelp is actually using confirmations so I just have to ignore the mail and that will all go away.
At least I was happy about it, until I started getting Yelp newsletters to that address.
Yelp gets half a star for attempting to do COI, but loses half for sending newsletters to people who didn’t confirm their account.
I really didn’t believe that people would grab a clearly tagged address off the blog and subscribe it to mailing lists or networking sites. I simply didn’t believe this happened anymore. I know forge subscribing used to be common, but it does appear that someone forge signed me up for a Yelp account. Clearly there are more dumb idiots out there than I thought.
Of course, it’s not just malicious people signing the address up to lists. There are also spammers harvesting directly off the website.
I did expect that there would be some harvesting going on and that I would get spam to the address. I am very surprised at the volume and type of spam, though. I’m getting a lot of chinese language spam, a lot of “join our business organization” spam and mail claiming I subscribed to receive their offers.
Surprisingly, much of the spam to this address violates CAN SPAM in some way shape or form. And I can prove harvesting, which would net treble damages if I had the time or inclination to sue.
It’s been an interesting experience, putting an unfiltered address on the website. Unfortunately, I am at risk of losing your questions because of the amount of spam coming in. I don’t think I’ve missed any, yet, but losing real mail is always a risk when an address gets a lot of spam – whether or not the recipient runs filters.
I’m still pondering solutions, but for now the questions address will remain as it is.

Read More

Equivocating about spamtraps

What is a spamtrap? According to a post I saw on Twitter:

Read More