Hacker News Reader

You need to publicly shame them on twitter. That is a massive breach likely happening to other users as well. HN has a decent audience but twitter has an enormous audience.

Tag some tech reporters as well for extra fun.

You need a personal audience for that. Posting on Twitter with 10 followers at best isn’t likely to make it.

not with the right hashtag or mentions

Why don't you go ahead and do that, and then report back to us on your success.

Yea like all social media platforms these days you usually have to pay in one way or a not to promote a hash tag. I bet most of the popular hash tags you know of were sponsored at some point.

I thought about that but I am no influencer type. The communication with Instacart makes me feel that they suspect I have stolen somebody’s credit card to make the purchase, and after they reopened my account I can see that person’s cell number and address and such, and I don’t know an easy way to go public without showing the proof, which is another person’s private information.

> I don’t know an easy way to go public without showing the proof, which is another person’s private information.

It might be worth sharing with a journalist; potentially the author of the linked article?

No! They would comply, post an apology and continue the same way. You need to sue them for data breaches and endangering personal info. Of course legislation has to come up for stuff like this. Best day for that would be yesterday.

I'm pretty curious how this happens technically -- is there a hash collision? Do they hash email addresses as a key or something?

It's gotta be something simpler than that. Perhaps there's a database rollback and now they have mismatched ID somewhere. Or perhaps the caching scheme wasn't thought out thoroughly and the caches got delivered to the wrong person. There's literally a million ways things could go wrong, and hash collision is the last thing I'll suspect.

Yep that's exactly what I told them that its mostly a hash collision when I was not willing to pay the chargeback unless they can explain why somebody else's number was on my account. That's why it makes me angry after I paid the chargeback and can still see another person's info in my account, that I realize they have all the information themselves already and they know the issue, they just refuse to fix it and acknowledge it. It's strange that they can see the mismatch information in my account all alone, but they only care about recovering the $80 chargeback, while I have already made another $1000 purchase from Costco. I think it may be a better approach to escalade to costco.

I know people on here might have GDPR fatigue, but in Europe you'd have a massive stick to incentivize them to make it right. This is exactly why regulation such as this is needed.

We shouldn't have to depend on publicity and shame to force a company to be careful with our data, we should have a neutral agency that investigates every report equally and is able to hand out fines for those companies that don't take our privacy seriously.

(I mean, California is on the right track)

You may underestimate how much of shit companies care. T-Mobile Netherlands have been sending me plenty of private information about one of their customers for months (their customer signed up using a.person@gmail.com as their email address, I've held the aperson@gmail.com account since 2006, hence I receive the emails).

I've tried escalating this with them multiple times, each time they insist that I won't receive any more emails, until the next one arrives. I also tried threatening them with taking it up with whichever authority is relevant if they don't fix it and reminded them about the 20m Euro or 4% of global turnover fine they could incur, yet still keep receiving this poor saps information.

In case you haven't already tried, I would contact their legal department. I would expect them to be far more invested and effective in fixing these breaches than anybody in the phone-based customer support chain.

Although it's about a different subject matter, I'm reminded of this quote from a patio11 article:

> [A bank's] CS department is scored on number of tickets resolved per hour, and each rep’s incentives are simply to classify you as something requiring no followup and get you off the phone. [...] The legal department (or an analogous group – it is different at every bank) is not scored on cases resolved per week. They are scored on regulatory incidents per quarter, and their target for success is likely zero. Shockingly senior people will be involved to avert regulatory incidents.

src: https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...

Then do it! Contact the Autoriteit Persoonsgegevens [1], that's exactly the point of my comment.

[1]: https://autoriteitpersoonsgegevens.nl/en/contact-dutch-dpa/c...

Have you tried contacting their DPO? Their privacy policy [0] lists dpo@t-mobile.nl as the email address to write to.

[0]: https://www.t-mobile.nl/Global/media/pdf/privacy-statement.p...

I'm not sure that's a violation of GDPR. If person A has accidentally authorised their personal correspondence to be sent to person B they are pretty culpable for the consequence. Good systems require you to verify your email address, but I'm not sure there's a legal requirement to enforce that.

Regardless, it's a very different problem to a bug introduced by the company that leaks customer information.

> I'm not sure that's a violation of GDPR.

I think the initial communication is obviously not the fault of the company, but as soon as they are aware and refuse to put right the situation, I think they are very much at fault.

Exactly, honest mistakes can, and do, happen. The cause should be investigated and if minor, logged on a register; if serious, it must be reported to the regulator.

The initial email was pretty bad, I immediately deleted it and contacted them, but it included:

- Full name

- Date of Birth

- Some kind of National ID number

- Bank account details

- Address

If I was of a lesser moral character I'm sure I could have been very naughty with that information.

Another possibility is the email address is read out (such as over the phone) and a staff member transcribes it incorrectly.

It's definitely a GDPR breach, but it may not necessarily be reportable to the data regulator. Imho it should definitely be reported to the data protection officer first before going to the regulator. Most frontline staff have no idea how to handle GDPR queries or issues, but it's the designated data protection officer's role to be responsible.

GDPR has a requirement that data be accurate (Article 5, section 1 d). This is applicable in practice because of the Right to Rectification, Article 16.

https://gdpr-info.eu/art-16-gdpr/

The initial issue is probably not a violation of GDPR, and not a reportable data breach. However, not fixing the issue after it was brought to their attention is more likely to be a violation.

I was at a friends place in a nearby town and got an order from Fry's (grocery store) where the guy charged me for 5 things he didn't deliver (about $30). I made a complaint (1* review, support ticket) and changed his tip to $0.01 because I couldn't set it to 0.

The next day I had 6 charges from 2 Fry's in the area of where I was the day before, totalling about $550 at stores I had never been to (and did not appear as instacart charges like they normally would). My bank gave me a fraud warning when they tried to use an atm. I still had the card in my possession. I reported it to Instacart and never got a response. My bank was able to reverse the charges as fraud though, fortunately.

So I don't know how, but at least 1 rogue instacart delivery people was able to get my atm card information and misuse it. If not, the coincidence that accounts for all the evidence is astronomical.

Had InstaCart this week charged my card in error. I told them, then they spent the whole week heckling me about card information, etc, claiming they couldn't find the charge, getting auto replies etc. Yesterday I just called my bank and filed a dispute. Problem solved. Instacart Cancelled.

Filing a dispute is the best way to go about lousy merchants...

You may be just the opposite of the issue I have with instacart. If so, I don't think the problem is solved. Instead, Instacart is probably displaying your private information to another person (who your card was charged for).

Why not create a new, separate account.

I keep a pre-paid credit card that i will occasionally refill for stuff like this. I keep my actual banking 2-3 steps away from anything online.

All charges go through a credit/charge card (usually amex).

If im particularly skeptical or its a company that requires card info for something that shouldnt (like some intro/free trial) i just use a prepaid card with a minimal amount im willing to lose.

Wow, thanks for sharing this. I’m going to close my Instacart account now. I haven’t used it in a while but I don’t want my data sitting on a platform that doesn’t care about security

Put these details in a certified letter sent to the legal departments of both InstaCart and Costco. They'll pay attention to an evidence trail.

Just tangentially related but recently I tried to buy something from an online store called Adorama and when I tried to place an order I got the notification of the charge from my bank after clicking the order button but the page didn't do anything, initially I though "well lets just get in touch with customer support, pretty sure they can see the charge and let me know what happen with it" oh boy was I wrong, their customer support only has access to orders not transactions, so when a bug in their website charged me without creating an order there is nothing they can do at all; all they did is recommend me to ask my bank to do a chargeback, but my bank says I need to wait 30 days after the transaction to so. So yeah, my lesson was the same, I should have had stick with Amazon because smaller stores just can't be trusted with handling purchases correctly.

Privacy.com... is my thing for this reason.

as soon as you can use a credit card to fund it, perfection.

that will probably not happen because they would be eating a credit card fee...

that service only works because they become the credit card processor and get to pocket the card fee...

Adorama is totally reputable and everyone is smaller than Amazon. Still super annoying to encounter things like that though.

Adorama is a huge company. Must be a top 1000 e-commerce vendor.

Adorama is legit, along with B&H they're one of the big names in cameras and photography equipment.

I've purchased from Adorama in the past without issues and you can call their salespeople for advice, which is unlikely with Amazon.

Online camera stores and places that sell $2500+ small, valuable, easily resold electronics are one of the #1 targets for credit card/identity fraud. It's likely that whatever you ran into is an unintended side effect of either Adorama's anti-fraud system, the anti-fraud system of their payment processor or your bank.

Adorama is a legit store, they've been around for 25+ years.

Why can't you go shopping yourself? I am genuinely curious, not being sarcastic. Costco is typically stuff that you buy once a month if that; can you not even spare an hour or two once a month to go shopping?

That was in May, shopping at Costco means waiting in line outside for a couple of hours. We are also a high risk household. Costco was the only shop that does grocery delivery at the time (amazon fresh was totally not available then). It’s an easy decision between shopping at store, or online and have them delivered the next day. We are using the Costco website, so I think maybe the bug is in their integration.

Fair enough. I never got the appeal of Instacart & the like but I guess it is good that the option is there should one need it.

I actually never used the Instacart app and I can care less. I do care about the Costco next day grocery delivery service, which has a transparent integration with Instacart. That is, I order on Costco.com and Instacart will deliver it next day. Costco won’t allow me to chose other vendors for delivery.

If you use Instacart app to order items from Costco the price is actually different. I guess using Costco.com I have my membership benefit.

> I actually never used the Instacart app and I can care less.

What is the meaning you are trying to convey here? Genuinely confused by this sentence.

I too see this phrase used and it often seems to imply the opposite meaning of what is intended. It is indeed confusing.

Generally the phrase is "I couldn't care less", meaning it is impossible to care any less than I already do.

I think "I can care less" is meant to mean "I can care less than most people do, because it doesn't matter to me".

In my experience people say "I can/could care less" when they mean to say "couldn't care less". An incorrect correction of the double negative.

Thanks for the language advice!

Sorry for the confusion. What I meant is that I have never made a purchase from instacart app or from instacart.com website. Instead, I am placing online orders in costco app (and sometimes with a browser on costco.com) for grocery. Instarcart is a vendor for costco's grocery delivery. When I say I don't care about instacart, I meant I am a customer of costco for this order journey, not a customer to instacart.

When did Costco have lines outside? I’ve been to several Costco’s during the pandemic and never waited at a single one. The worst that happened was toilet paper being out.

It impressed me why people still think that their anecdata somehow applies to the world. Your personal experience has nothing to do with the experience of the previous shopper and there is no reason why you should doubt them for such a mondane thing. Or you could just use Google and reads the dozens of results. Someone even came up with an app in Toronto to track COVID lines at Costco https://www.blogto.com/eat_drink/2020/04/costco-stores-toron...

Costco is worldwide?

Costco operates in a dozen countries.

Is this supposed to a be rhetorical question or are you genuinely unable to use Google to discover simple facts?

If the two choices are "costco serves me" and "costco is worldwide", the latter is much closer to the truth.