So Glassdoor updated its terms of service, and dutifully notified its users by putting all their email addresses in the TO: field. Yeah, you read that right.
And no one apparently noticed before hitting SEND.
Leading to a second email later today:
Dear Glassdoor User:
Earlier today we inadvertently exposed your email address to other
recipients during a routine e-mail distribution regarding changes to our
Terms of Use.We are extremely sorry for this error. We take the privacy of our users
very seriously and we know this is not what you expect of us. It certainly
isn’t how we intend to operate.If you have any questions, please contact us at [email protected].
Sincerely,
The Glassdoor Team
Thanks to Jeanne Price for letting me know about this one. I wonder whether anyone hit reply-all as that would have been quite a storm. 🙂
So I got won of these apology emails, but what does this breach mean?
Not much, actually, except that depending on whether you used a tagged/throwaway email address with them, you might start receiving more spam or phishing attempts.
What a coincidence, that right after I get this message when logging into Glassdoor:
“We have temporarily disabled your account. We have identified that your password matches one you have used on an unrelated website that has experienced a security breach. Please reset your password here.”
So they screwed with their own security and now try to blame some fictional 3rd party website (how would they know what password I use in that unrelated website? how would they have access to that information? Just tell me which website had that breach, I will decide whether to change my password)
Javier, I got the same message. Seems to me like if they wanted to be helpful they might actually name the “unrelated site” instead of leaving that account wide open.
I also got the email We have temporarily disabled your account. We have identified that your password matches one you have used on an unrelated website that has experienced a security breach. Should I be concerned?
Were you notified by the “unrelated web site,” too? If not, yeah, you should be concerned enough to insist Glassdoor tell you who the other site was so you can contact THEM and ask them what data of yours were compromised, etc. And if you used the same login credentials at a third or fourth or fifth site, better change all your passwords.
Can someone forward me the email?
No, because I remove email addresses from submissions. I posted the notification email in the story itself.