Disney Destinations E-mail server hacked?

[MMrules]

Figures can't get a PIN from Disney Destinations but I can get this..... Go figure.

Me too!!! I thought that my email account didn't work from them as I have never gotten a Disney Destination email....now I finally do and it will probably give my computer cooties!!!!

 

[BriarRosie]

I find it interesting that I'm on the Disney Destinations mailing list, since I get new offers from the Disney Vacation Club and Disney Movie Rewards and such, but I didn't get an email warning me of the breach.

I checked my spam folder, nothing there either. Should I feel relieved?

 

[archdandy]

I got one from DD as well.

 

[3happydancers]

Me too! Received one from DD and one from HSN. Hope that is the end of it. Now to be extra careful with my emails.

 

[addicted2mickey]

I got the same email, but on Friday morning I see an email was sent to all of my contacts and it wasn't from me (some sent back due to old email addresses). One friend said it looked like it was written in German. I immediately sent out an email and put on facebook not to open previous email, I then ran virus scans, twice and nothing there. I changed password and opened a new account for credit cards, etc. Hmmmm, not sure if it is connected with the Disney Destination problem or not. Wonder if I could get them to give me Free Dining with my fall vacation?!?!?

 

[moepanz]

I find it interesting that I'm on the Disney Destinations mailing list, since I get new offers from the Disney Vacation Club and Disney Movie Rewards and such, but I didn't get an email warning me of the breach.

I checked my spam folder, nothing there either. Should I feel relieved?

I did not get any emails either and I am on all of those lists as well . My husband suggested to change my password anyway so I did.

 

[k5jm]

The good news: I finally get an email from disney destinations

The bad news: my account information has been compromised

the email i received from college board is a bit more forthcoming as to info, see below:



Epsilon has assured us that the only information that may have been obtained was your first and last name and e-mail address. REST ASSURED THAT THIS VENDOR DID NOT HAVE ACCESS TO OTHER MORE SENSITIVE INFORMATION SUCH AS SOCIAL SECURITY NUMBER OR CREDIT CARD DATA.

FYI, Folks! You need to know that this will turn into a HUGE phishing scam. These people now have your name and email address. They can now send you an Email posing as the original company and try to get you to change your passwords, get additional information, or even sell your e-mail address to other spammers and spinsters.

Please note, it is possible you may receive spam e-mail messages as a result. We want to urge you to be cautious when opening links or attachments from unknown third parties.

The only problem is that the phishing/spam messages will appear to come from Destination Disney, HSN, College Board, or the other affected companies.

You never expect malicious email from those you know. That is why the boilerplate response from Epsilon (which the other companies just copied) is misleading and deceptive. I would be suspect of any email from Destination Disney or any of the other affected companies.

 

[tinkmom2]

It's not only Disney, I got 5 other emails from companies such as HSN.

 

[Fundytrail]

I hope this statement is correct!

"We want to assure you that your email address was the only personal information we have regarding you that was compromised in this incident."

To be on the safe side I did change my password as the Disney Login has VERY specific information about us and our family!

 

[rhyeck]

I believe the Disney Destination Warning E-mail may be the spam. I received an e-mail from the REAL Disney Destination today re: making reservation inquiry for the Polynesian. Looks like the REAL e-mail address for Disney Destination is "disneydestinations@email.MyDisneyParks.com". The spam e-mail address came through as "disney@vacation.disneyworld.com". Whatcha think? The warning message IS the spam? I am far from computer guru, but maybe?

 

[FireDancer]

I posted this on the thread about this on the community board:

The most important thing anyone can do to safeguard their email is to have a good password which includes upper and lower case letters, numbers, and symbols for their email. Someone having your email in itself isn't really a threat and long as you are careful about the links you click in emails and the files you open. What is dangerous about someone having your email is what they can deduce from it or what they can do with it as part of a blended threat.

Here is an example. Lets say your email address is JohnSMith123@hotmail.com. Chances are your username at banking, shopping, and other sights is the same (JohnSmith123) or, worse, the sites use your email as your user name. If I can get into your email account I can reset or get access to all of your banking passwords because almost all of the sites have a "forgot your password" link that uses your email to reset the forgotten password. This is why your email password needs to be complex and different from every other password you have.

Why different? Well that is where the blended threat comes in. I have your email and can send you a phishing attack that states your information at Chase/Citi/BofA/whomever has been compromised. You log into the fake site and enter your Chase/Citi/BofA password and I now have that site's username and password along with your email address. That is bad enough but if you use the same password for your email address as the credit card or banking site I just impersonated I not only have your username and password for that single site but I can get into your email and use it like I described above to get into all of your e-commerce sites.

There is little you can do to keep your email private. I go with the assumption that everyone on the planet has mine. What is important is you secure it with a good, strong password that is unique to only your email account and that you are careful about links you click in email. If you get an email from Chase don't click a link in the email, go directly to the Chase site and log in there. I am the I.T. director of a financial institution and if we had a breach we would never send a link in email to have our clients change their passwords or information for this reason. We would have a link provided right on our site where you can check the validity of the SSL certificate before proceeding.

As HonestAbe stated in his other post third parties have a lot of information. This isn't only try of email lists but third parties clear credit cards, checks, ACH transactions, and a lot of other financial instruments. It is the way of the world and they, unfortunately, have breaches. Sadly most aren't as good with sensitive information that should be encrypted or hashed instead of stored in databases in the clear.

I would recommend everyone change their email password if it is weak or shared among multiple sites and be vigilant about what you click in email. I'd also learn how to check the SSL certificate of any banking or shopping site I use. A quick Google search will tell you how to do this in your browser.

 

[Fundytrail]

The email is no scam just google "Epsilon Security Breach" (see link below).

http://news.yahoo.com/s/mashable/20...ilon_responsible_for_gigantic_security_breach

Disney is not alone as the following have also been affected;
Kroger
TiVo
US Bank
JPMorgan Chase
Capital One
Citi
McKinsey & Company
Ritz-Carlton Rewards
Marriott Rewards
New York & Company
Brookstone
Walgreens
The College Board (added 4/3 @8:20am)
Home Shopping Network (HSN)(added 4/3 @10:22am)
LL Bean (added 4/3 @1:20pm)
Disney Destinations (added 4/3 @1:20pm)
Barclays Bank of Delaware (added 4/3 @1:20pm)

 

[k5jm]

I am not going to let my guard down, but this is from Epsilon's website. Notice the date.

http://www.epsilon.com/News & Event...Unauthorized_Entry_into_Email_System/p1057-l3

Epsilon Notifies Clients of Unauthorized Entry into Email System

IRVING, TEXAS – April 1, 2011 - On March 30th, an incident was detected where a subset of Epsilon clients' customer data were exposed by an unauthorized entry into Epsilon's email system. The information that was obtained was limited to email addresses and/or customer names only. A rigorous assessment determined that no other personal identifiable information associated with those names was at risk. A full investigation is currently underway.

I wonder why they wouldn't have released this on March 31st.

 

[pxlbarrel]

Hmmm...that explains the weird spams that I've been getting that include my entire name. Luckily, I don't think I've ever given Disney Destinations any credit information anyway. The emails are annoying though. At least the mystery is solved.

 

[Claudia Kellenberger]

So what happens now? How can we still be in touch with Disney Destinations?
Will they change their server? Will we ever get the PINS we used to get?
Is it all over now?

 

[FireDancer]

So what happens now? How can we still be in touch with Disney Destinations?
Will they change their server? Will we ever get the PINS we used to get?
Is it all over now?

Disney wasn't compromised so your interaction with them will not change at all. Epsilon is a 3rd party which Disney uses for limited email functions and they had a compromise. This breach, while problematic, will ultimately have very little effect on you the end user. My company was part of the Hartland credit card data breach and for as much press and hoopla as that got our customers ended up with a whopping $0.00 impact. We, on the other hand, were proactive and absorbed some limited cost which was ultimately covered by our insurance.

As long as you are smart enough to secure your email account and not get phished you (general you) will almost certainly be just fine based on the information that is currently available. That last part is subject to change if the information provided by Epsilon changes.

Oh, and lastly, does anyone know if Epsilon was actually hacked? Many data breaches involve absolutely no hacking and merely one person to be irresponsible with data. For all I know someone lost an unencrypted backup tape or emailed a text file to the wrong email address.

 

[msminniemouse]

I got the same email, but on Friday morning I see an email was sent to all of my contacts and it wasn't from me (some sent back due to old email addresses). One friend said it looked like it was written in German. I immediately sent out an email and put on facebook not to open previous email, I then ran virus scans, twice and nothing there. I changed password and opened a new account for credit cards, etc. Hmmmm, not sure if it is connected with the Disney Destination problem or not. Wonder if I could get them to give me Free Dining with my fall vacation?!?!?

I had a similar thing happen to me a couple of weeks ago on the same day that I got the warning email from tripadvisor. It seems that spam emails containing links, were sent out to all of my contacts, and I only found out because some of the emails were sent back due to old outdated addresses.

I have received the latest emails yesterday and today from: Brookstone, New York and Company, Disney and HSN.

 

[WebmasterAlex]

The whole story on this is not out yet.
Marriot and Ritz Carlton are now saying that their member point balances were also exposed. That's tailor made for a phishing expedition so really we need to distrust emails even from legitimate vendors we have a relationship with. I can see it now
Dear John Jones,
We at Marriot Rewards want to offer you a bonus 5000 points to add to your current total of 34,200! Please call us at 800-Rip-Offs to claim your points.

The email will have a marriot logo and look totally official. Think anyone is going to fall for it? Count on it

 

[k5jm]

The whole story on this is not out yet.
Marriot and Ritz Carlton are now saying that their member point balances were also exposed. That's tailor made for a phishing expedition so really we need to distrust emails even from legitimate vendors we have a relationship with. I can see it now
Dear John Jones,
We at Marriot Rewards want to offer you a bonus 5000 points to add to your current total of 34,200! Please call us at 800-Rip-Offs to claim your points.

The email will have a marriot logo and look totally official. Think anyone is going to fall for it? Count on it

My thoughts exactly!

 

[disneyholic family]

this is why i refused online banking when it was offered to me by my bank.
They said, "don't worry"...."perfectly safe"....etc etc.

i said, "there's no such thing as perfectly safe on the internet" and i refused anything on the internet....not even being able to just see my balance..
nothing...