Hacker News Reader

Comment by save_ferris | Hacker News Reader

It's weird to me that we're hearing about this from the press instead of Instacart. If a suspected data dump of Instacart user data made its way to the dark web, surely it wouldn't be difficult for Instacart to buy a subset of it and confirm or deny its validity.

If I was an Instacart customer, I'd feel a lot more comfortable with a preliminary "we're aware and looking into this" statement from Instacart directly as opposed to doing nothing and telling the press that they don't know anything.

When a data dump like this hits the dark web, are companies even legally obligated to look into it?

View on HN

In California, yes.[1]

Instacart has not yet reported this breach to the California attorney general, like they're supposed to.[2] There's a long list of companies with data breaches there.

[1] https://leginfo.legislature.ca.gov/faces/codes_displaySectio...

[2] https://www.oag.ca.gov/privacy/databreach/list

To consider one possible scenario in-depth:

If it’s a leaked-passwords attack used to compromise an unknown number of accounts that had insecure passwords, is it possible for Instacart to prove a breach occurred to the degree necessary to trigger the notification requirement?

Is it even a breach at all, in that scenario? How is Instacart at fault?

Is it necessary to integrate with haveibeenpwned to avoid having to publish a new breach notification every day that at least X accounts with an insecure password are accessed without consent? Is this requirement codified in law, or must each business discover it the hard way?

More paranoid sites may ask when they notice unexpected login sources from geolocation not matching up. I have had that a few times with imprecise addresses and getting warnings from gmail about a DC login attempt while attempting a login from another location.

Not certain about what is legally expected however.

Keep in mind that developers hear a user needs to be notified in “the most expedient time possible” and think minutes or hours but the lawyers read that and are thinking days or potentially even weeks in some circumstances. Just because Instacart hasn’t notified anyone yet doesn’t mean they won’t or that they’ve failed to comply with the obligation.

Then the law sounds ineffective to me. There are security researchers featured in this article saying that this dump looks legit, and Instacart still gets to pretend like everything is normal? User data could wind up sitting on the dark web for weeks before Instacart finally gets around to notifying them of the breach.

Tools like haveibeenpwned typically rely on companies' cooperation to report breaches since "data breach" is a legal term. But since Instacart still hasn't reported this, do the security tools get updated in a timely way, or are there millions of credit cards and passwords sitting up for sale while lawyers figure out how to handle the legal side of this?

it's almost as if the law was specifically written this way to sound useful, but is actually toothless

Looks like Couchsurfing didn't report their breach either.

https://news.ycombinator.com/item?id=23912112

Pretty sure every single state has some form of breach notification law.

For some background on how legal it is to obtain (your own) data dumps, Leonard Bailey (US DOJ) did a great talk at RSA Conference 2020 (I attended this talk in person) on "Human Dimensions of Active Defense":

https://www.rsaconference.com/usa/us-2020/agenda/human-dimen...

His talk covers a lot of active defense techniques, and goes over some legal points in this area.

Link to the specific section, "Reacquiring Stolen Data": https://youtu.be/CNonofF0_lw?t=2177

This assumes there was a hack. If there wasn't, then there's nothing they can really do. They couldn't have reached out to customers before, they can't say they're looking into it (because there's nothing to look into), etc.

It feels to me that a few people got phished, and their accounts are being sold as proof. The rest could just be fake.

(Or, there was a hack, and Instacart handled it badly!)

Ok, I've edited the title to say what the article actually claims (i.e. its first sentence) rather than the stronger claim in the headline.

I would think that Instacart buying data obtained allegedly illegally -- even though it's allegedly their own data -- is likely a legal minefield.

In fact, my understanding is that generally buying a known ill-gotten item is illegal even in meatspace. Does it having originally been yours change that?

Lots of relatively large companies have whole lines of business based on buying dark web account dumps, and, last time I looked into it, the conclusion I reached (I'm not a lawyer, just someone who nerds out on this stuff) is that you're legally safe buying with the intention of recovering your own stolen data. You're probably crim-law safe regardless of whose data you're acquiring, as long as you're not a party to or have any kind of durable relationship with the people stealing the data.

Experian's lawyers were apparently comfortable enough with this line of work to buy a company that does it outright (CSID).

It was interesting because I'd worked at a startup, which used data from the people CSID had hired and that startup was acquired by Experian. At the startup we'd concluded this work was toxic and it'd be crazy to touch the company, we ensured the arrangement was completely at arm's length yet less than ten years later a huge public company felt it was OK to just buy the whole thing and swallow it.

Reply on news.ycombinator.com