Possible email address leak at Ladbrokes?

[jasonuk]

I'm rather pedantic when it comes to email - after a decade my email addresses became rather swamped in spam so I started to set up unique aliases for each email source (with lots of random characters and other protective measures - it's worked remarkably well over the past couple of years, three breaches were spotted long before they hit the media, the other two were never disclosed).

Yesterday, I started receiving gambling-themed spam to my Ladbrokes alias (which itself is an account I haven't used in nearly a year). I did some digging on my email server, flagged it up with their support team who sent me this rather helpful response:



Of course, I went to the trouble of setting up these email aliases and then signed them up to a spammers mailing list...

Just a heads-up for anyone who has an account with Ladbrokes!

 

[Deeplay]

I'm rather pedantic when it comes to email - after a decade my email addresses became rather swamped in spam so I started to set up unique aliases for each email source (with lots of random characters and other protective measures - it's worked remarkably well over the past couple of years, three breaches were spotted long before they hit the media, the other two were never disclosed).

Yesterday, I started receiving gambling-themed spam to my Ladbrokes alias (which itself is an account I haven't used in nearly a year). I did some digging on my email server, flagged it up with their support team who sent me this rather helpful response:

View attachment 56474

Of course, I went to the trouble of setting up these email aliases and then signed them up to a spammers mailing list...

Just a heads-up for anyone who has an account with Ladbrokes!

it does not matter how creative an email is. Software that harvest emails cares not. A person could use as many random characters as they like but if you name gets onto a list then it wont stop the mail arriving at your inbox. Sure it may get flagged as spam and so you dont see it but a footprint will still be left.

I have 2 email accounts I use for my vices ... and never use them for anything personal. In the end both these accounts have had there fair share of spam. Lists do get shared and crossed over as annoying as it is. Sounds like what ladbrokes are saying is you opted in to allow a sites "carefully selected partners" to send you promotional material. Often happens that some of the webforms are pre checked / crossed so a person would have to "uncheck" to not give permission to be part of a mass mailer. Strictly speaking this is against the TOS of the canSpam legislation carried forward years ago but in the end companys do get round this. Annoying as it can be a robost spam filter is pretty much the best defense against this kind of thing and of course if you know the name of the company taking it back to them and hoping they do the right thing to remove your email addy.

For total security (and this even aint 100%) your best bet would be Tor mail or a bullet proofed mail provider the latter does involve cost though.

 

[jasonuk]

it does not matter how creative an email is. Software that harvest emails cares not. A person could use as many random characters as they like but if you name gets onto a list then it wont stop the mail arriving at your inbox. Sure it may get flagged as spam and so you dont see it but a footprint will still be left.

For total security (and this even aint 100%) your best bet would be Tor mail or a bullet proofed mail provider the latter does involve cost though.

At the risk of going off on a tangent...

I fully agree - which is why I run my own mail server The randomness is to discount a dictionary attack or "common" alias (if I'd used ladbrokes@ then they could have just guessed it). I'm not for a moment assuming it'll protect me from spam, but it's to identify a potential source when such an incident occurs - as every service or opt-in gets a new and unique alias, I know exactly where it's been used. It's understandably a bit of a pain to set up, but it has been pretty reliable so far at picking up data breaches and where my email has been sold on

No untoward behaviour in the server logs, which indicates they had the email address already. I know that Ladbrokes use a third-party provider for their newsletters, so it could be as simple as that... I would be extremely concerned if their core servers had been breached, but I strongly suspect that isn't the case here.