Amazon customers’ names and email addresses disclosed by website error

[Arthur]

https://arstechnica.com/information-technology/2018/11/amazon-customers-names-and-email-addresses-disclosed-by-website-error/

 

Some Amazon customers woke up on Wednesday to an email saying a technical error caused the site to disclose their names and email addresses. While Amazon officials have said the emails are authentic, they aren’t providing additional details beyond what’s in the extremely terse communication.

 

Wednesday’s email doesn’t say how long customers’ personal details were disclosed or precisely where on the site the disclosure took place. It’s also not clear how many customers received the email and whether a geographic location, specific purchase, or other common thread caused certain customers to be affected.

 

Below is the text of an email sent to one Amazon customer:

 

________________________________________

From: Amazon.com

Sent: 21 November 2018 10:53

To: [email protected]

Subject: Important Information about your Amazon.com Account

 

Hello,

 

We’re contacting you to let you know that our website inadvertently disclosed your name and email address due to a technical error. The issue has been fixed. This is not a result of anything you have done, and there is no need for you to change your password or take any other action.

 

Sincerely,

Customer Service

http://Amazon.com

 

An Amazon representative told Ars, “We have fixed the issue and informed customers who may have been impacted.” However, the representative declined to provide additional details. On background, the company is saying that the disclosure wasn’t the result of a website or systems breach but rather a technical error that is now fixed. The company is emailing customers out of an abundance of caution to let them know their email addresses and names were disclosed.

 

Translation: the disclosure was likely the result of a programming error or bug that made select Amazon customers’ names and addresses available either to the public at large or specific people. There's no reason to believe the information disclosed included payment card data, physical addresses, past purchases, or other personal details. For however long the disclosure happened, it has now been fixed.