Gyft experiences severe data breach. Users now being notified.
businesswire.com/news/home/20160205005917/en/...Posted Feb 6, 2016, 4:21 PM UTC
5327
businesswire.com
Notice of Data Breach
Dear Gyft User,
We are writing to let you know about an incident that potentially involves your Gyft account. As described below, an unknown party may have gained unauthorized access to certain Gyft user information. We are taking this incident very seriously. As soon as Gyft learned about the exposure, we began investigating how this user information was accessed and what risks this potentially posed to Gyft customers. Fortunately, we have not discovered evidence that anyone used the information potentially compromised in this incident to access Gyft accounts or make unauthorized purchases.
Nonetheless, please carefully read this notice.
What Happened?
Beginning on October 3 and continuing through December 18, 2015, an unknown party accessed without authorization two cloud providers used by Gyft. This unknown party was able to view or download certain Gyft user information stored with these cloud providers and make a file containing some of that user information.
What Information Was Involved?
The information potentially accessed from the cloud providers included names, addresses, dates of birth, phone numbers, email addresses, and gift card numbers. Gift card numbers could have been used to make unauthorized purchases. In addition, if you attempted to use Gyft between March 19 and December 4, 2015, your Gyft log-in credentials may have been compromised. An unauthorized party who acquired your credentials could have accessed your Gyft account and used any gift cards in your account with unused balances, or used available reward points or a Coinbase-enabled account to purchase additional gift cards. Importantly, no credit cards stored in your Gyft account were compromised because full credit card numbers are not visible in Gyft accounts and any credit card purchases require the three- or four -digit security code on the back or front of your credit card, which was not part of the information that may have been compromised.
What Are We Doing?
Shortly after discovering this issue, Gyft acted to prevent unauthorized access by forcing users whose passwords were potentially compromised to reset their passwords and logging out other affected users. Affected users who have not already done so will be forced to choose a new password the next time they log in. We also reset the Coinbase tokens for all affected customers. We are continuing to investigate the incident and will take all appropriate steps to protect Gyft customers.
For the latest information on this incident go to: www.myidcare.com/gyft.
What You Can Do
We recommend that you change your password for any online account where you use the same password that you used for Gyft between March 19 and December 4, 2015. As discussed above, credit cards stored through Gyft were not affected by this incident. However, if you have a Coinbase account linked to your Gyft account, we recommend that you review any Coinbase transactions beginning in October 2015, because a linked Coinbase account could have been used to make purchases within your Gyft account. You should also monitor any gift cards that were in your Gyft account before January 8, 2016.
Although the information potentially involved in this incident does not affect your credit, we are required by law to provide you certain information about your credit report and identity theft. This information is enclosed.
You may also contact us in writing at 150 W. Evelyn Avenue, Suite 300, Mountain View, CA 94041, or you can call us at 866-287-0504.
On behalf of Gyft, we regret any inconvenience this may cause you.
Sincerely, CJ MacDonald Chief Operating Officer, Gyft
Additional Information Regarding Identity Theft and Your Credit Report
The Federal Trade Commission (FTC) provides information about how to avoid identity theft and what to do if you suspect your identity has been stolen. You may contact the FTC at FTC Identity Theft Clearinghouse, 600 Pennsylvania Avenue, NW, Washington, D.C. 20580, www.consumer.ftc.gov, 1-877-ID-THEFT (877-438-4338). You can also contact local law enforcement or the attorney general’s office in your state if you suspect that you have been the victim of identity theft.
You also may obtain a free copy of your credit report maintained by each of the three credit reporting agencies by visiting www.annualcreditreport.com or by calling toll-free 1-877-322-8228. Review the reports carefully, and if you find anything you do not understand or that is incorrect, contact the appropriate credit reporting agency.
You also may consider contacting the credit reporting agencies directly if you wish to put in place a fraud alert or a security freeze or to obtain additional information regarding identity theft. An initial fraud alert is free and lasts for at least 90 days. The alert informs creditors of possible fraudulent activity within your report and requests that the credit company contact you prior to establishing any accounts in your name. In contrast, a security freeze prohibits a credit reporting agency from releasing any information from a consumer’s credit report without prior written permission. Placing a security freeze on your credit report may delay your ability to obtain credit.
To place a fraud alert or security freeze on your credit report, contact any the three credit reporting agencies using the contact information below:
Equifax: 1-800-525-6285; www.equifax.com; P.O. Box 740241, Atlanta, GA 30374-0241 Experian: 1-888-EXPERIAN (397-3742); www.experian.com; P.O. Box 9554, Allen, TX 75013 TransUnion: 1-800-680-7289; www.transunion.com; Fraud Victim Assistance Department, P.O. Box 2000, Chester, PA 19022-2000
Questions? Please do not reply to this email. Visit www.myidcare.com/gyft or call us at 866-287-0504.
2
In addition, if you attempted to use Gyft between March 19 and December 4, 2015, your Gyft log-in credentials may have been compromised.
How is that possible? Did they store your ids in cleartext and keep them in logs on a random external third party website? What is wrong with these bitcoin companies?
2
Gyft is not a bitcoin company
1
I haven't gotten an email but I never gave them personal information and always used bitcoin. Nice try hackers.
2
[removed]
1
[removed]
1
Have an account that uses Google+ only to log in. My name and email are visible. Birthday and phone aren't in my profile. Don't see an address portion at all in my account using Google+ to log in. All gifts claimed by me and didn't use Coinbase.
1
I use Gyft a lot and it looks like my account was not accessed.
Good thing I don't keep any real important data on those servers thanks to Bitcoin.
1
I use Gyft a lot and it looks like my account was not accessed
How do you know?
2
I didnt get an email.
1
In addition, if you attempted to use Gyft between March 19 and December 4, 2015, your Gyft log-in credentials may have been compromised.
fak
1
I don't have a Gyft account, but I do have a coinbase account. Is this a blanket notification? I received a paper letter in the mail with this info today. I'm worried that someone opened a gyft account in my name. Guess I'll need to call.
1
OK, it sucks, but it doesn't sound so bad. No card data accessible. Only partial personal data and nothing that could affect credit. Card balances stored in Gyft should be fine. It's only physical cards, correct? So, I change my password and possibly argue to get cards replaced? That's not too bad.
-1
So you think having your birthday, name, address, usernames, passwords, gift cards, coinbase accounts all compromised is not bad. But having an easily replaceable credit card number would be too much.
Theze fucking corporations have it so fucking back asswards. I don't give one fuck about easily changible credit card numbers. I do give a fuck about my unchangible personal info.
Also noticeably absent was any mention of passwords being hashed. It appears, from the language, that they were plain text. If this was the case, then they provided no security at all and white frankly can't give one shit about their customers, which this announcement kind of displays.
9
There was less information exposed in eBay's databreach and everybody made it sound like it was the end of the world. All the information exposed by them you could find in phonebook.
1
Let's look at this thing without a victimhood complex getting in the way.
Coinbase says the following data was compromised:
"names, addresses, dates of birth, phone numbers, email addresses, and gift card numbers"
None if this data is usable, outside of sending you a bloody birthday card, except the gift card numbers.
"Gyft log-in credentials"
If you're using another service to log in, you're using bad password practices. If you're using the same password anywhere else, you're using bad password practices.
"a Coinbase-enabled account"
If you linked your Coinbase account and gave them access to all of your wallets you're missing the point of Bitcoin and how it can be used to secure yourself from things like this.
So, what is Gyft doing?
"forcing users whose passwords were potentially compromised to reset their passwords and logging out other affected users"
Users affected will have to change their passwords. Good. They should have done that whether they were notified or not. I have.
"also reset the Coinbase tokens for all affected customers"
Users affected will have to log in again, if they do so at all. Good. Let's hope they follow best practices this time.
Balances
Although they don't explicitly say it, the wording they use to tell you to monitor your balances says to me that Gyft is going to remedy any missing funds. This will probably be as simple as emailing support with a grievance.
And, what should you have done?
User data
Stop feeling like a victim. Nobody outside of yourself and your immediate circle of family of friends cares about any of this data. They're not going to call you. They're not going to send you a birthday card. They're not going to drop by for tea.
Login credentials
You should be using a password wallet. You should have a different password for every place you log in. You should be using Two-Factor Authentication. Your point about hashed passwords means nothing if you're following best password practices.
If using Coinbase
You should never allow a service to have access to your whole account. Coinbase should allow you to create a wallet specifically to use with Gyft and only fund it when looking to purchase a card or three. Gyft should only connect to that particular wallet when buying cards. All your other funds should be protected. This is the way the Shift card works. Until this is put in place, linking the two is bad Bitcoin practices. Until then, use their Bitpay link and pay them directly.
You can have it easy or you can have it secure. But, also, going overboard from paranoia isn't going to save you from anything. In fact, you're probably going to make things worse.
Besides, coming in here and shilling about the benefits of credit cards in situations like this isn't going to get you anywhere. I'm not even going to touch on that subject.
-1
I have never used gyft and I've never lost coins or assets to an exchange or a hack. I have signed up for gyft with fake info, but realized I don't have any fucking use to patronize the establishments they used. I use bitcoin; I'm not shilling creditcards nor do carry them around or use them. I'm talking about company with shitty practices. Hashing credit card numbers is the fucking law and the bare minimum to be PCI compliant. This company, as do most others, only appears to have only done the bare minimum for security. I am not positive of that though as their announcement has shit for details.
I ask you, If you had a mailing list of your friends or even strangers, would you post that shit all over the place, or feel some responsibility to keep it safe? All my important data is encrypted by choice.
I believe...as I stated, that companies should do more to protect consumers information if they require it for business, especially ones that tout themselves to the crypto community. Be it to guard against hackers or the fucking government. We need more security, not less, or some kind of apathetic acceptance that shitty data practices are okay.
I don't care if you don't care about your personal information. I care about my personal Information and I bet a lot of other folks do to.
So that's our little difference and that's how it is I guess.
1
Well, not quite. The three points of greatest concern I think are:
-
Gyft card codes have been compromised- so any gyft cards in your account could have been spent (during a particular date range).
-
Accounts linked to coinbase could have fraudulent purchases of gyft cards (and spending of those cards).
-
Users with poor password practices, who have other accounts online using the same email and password could be subject to further attack.
So far as I can tell, I have not been affected. My gyft cards hold no current value, I didn't link my coinbase account, and I have good password practices. Not trying to be an alarmist, just woke up to this email and thought I would spread the word a bit. Gyft appears to be handling this properly after the fact, I just hope they recognize the high-stakes space they are in and don't let this happen again.
4
Most of that can be validated by Gyft. But, yes, poor password practices are a problem. But people don't do that anymore, right? We all use password wallets and 2FA, right? All good?
Right?
Guys?
1
Glad coinbase kicked me out last year. ;)
This is sad, I really like Gyft. Didn't use it a lot but they bring a lot of value to the community.
1
And they will continue to do so. This isn't going to stop me from using them.
1
Breached 4 months ago, you're just being told now.
That's fine right guys??? guysss?????
They craptsied
this is totally abso-fucking-lutely why
[deleted]
[removed]
###Bwhahahahahahahahahahahahahahahahahahahahaha!! 😪
Again:
Or, go with option C: don't give anyone your identity details?
[deleted]
That's pretty good actually. I think the average is six months before company knows they're hacked