On Top Of Spying On Its Users, Sears Reveals Your Shopping Data To Anyone Who Wants It

from the well,-that's-useful dept

Weren't we just discussing the idea of criminal liability for egregious security problems with data? And... weren't we also just discussing Sears' offering to install spyware on your computer without much notice and all in the name of community? Well, let's combine those two stories. Ben Edelman has been doing some more digging on the Sears website and discovered a rather massive security hole allowing you to look up the purchases at Sears of just about anyone so long as you know their name, address and telephone number. As Edelman notes, this appears to be in direct violation of Sears' own privacy policy (and, well, common sense, but that's a different story...). So, now, Sears.com is spying on users without making it all that clear and revealing all customer purchase data with poorly implemented security. It's not a particularly comforting picture.
Hide this

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: ben edelman, privacy, security, shopping data
Companies: sears

Reader Comments

Subscribe: RSS

View by: Time | Thread

  1. identicon
    ehrichweiss, 4 Jan 2008 @ 2:29pm

    Re: Re: Re: Sears

    Good point(really) but someone has to actually drive around a city looking for those boxes whereas with this info being online, you can sit at home and case entire neighborhoods for loot. Then you can take your time casing the physical aspects.

    But wait, there's more.. If I know your name and telephone number and that you've made a purchase from Sears, it becomes a trivial task to social engineer other information as well.

    "Hi, this is the Sears Warranty Support Center. I see that you recently purchased one of our plasma televisions but you neglected to get an extended warranty on it."

    Customer: "What!?!?! I paid $300 for a 5 year service plan"

    "Sorry, we don't have any record of that. Can you please tell me the credit card number you used for the purchase?........and that expires when??? Hmm, sorry, I still don't show anything...oh wait, here it is...they mistyped your DOB in our system. It's all fixed now. Sorry for the inconvenience"

    It REALLY is that easy and the customer will thank the "representative" for helping resolve the "problem", and it's only that easy because all of that information is available.

    P.S. We take all of the boxes to any expensive items and put them in front of some neighbor's house that we don't like. We do this regardless if it's Xmas or the like. So this year I imagine that some crackhead will break in trying to find their new Wii.

Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here

Subscribe to the Techdirt Daily newsletter

Comment Options:

  • Use markdown. Use plain text.
  • Make this the First Word or Last Word. No thanks. (get credits or sign in to see balance)    
  • Remember name/email/url (set a cookie)

Follow Techdirt
Special Affiliate Offer

Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Recent Stories

This site, like most other sites on the web, uses cookies. For more information, see our privacy policy. Got it

Email This

This feature is only available to registered users. Register or sign in to use it.