True to form, Linden Lab are now blaming its customers for the leak of card names and email addresses.  They claim that the data breach is due to poor computer security on behalf of those whose data has been compromised.

FJ Linden responded in the form thread (post 31) and said

01-06-2011 05:26 PM

I say that it’s about time that Linden Lab employed some people who have business experience.

Which was promptly rebuffed (post 34) by one of those affected.

         Reply to FJ Linden – view message

01-06-2011 06:58 PM

1) I received these spam-emails to 3 addresses used for SL. 2 of these are ONLY used for SL. And NONE of my other email-addresses received these spam-emails and I have dozens of addresses. One for each account on some website or other. As I said NONE of these other email-addresses received the spam. It is highly unlikely (though admittedly not impossible) for a spyware to randomly get just 3 addresses that are known to SL and none of the others. If my math is correct then the statistical probability for this is about 0.3%. (8 out of my total of 50-60 email-addresses are known to SL)

2) I know how to take care of my computer-security. I have 20+ years of experience as an IT-professional (programmer and webserver-administrator). NEVER in all those years have I had a virus/spyware on my computers. I use Firefox with Noscript-plugin to keep Java, Javascript and Flash disabled for almost all websites except trustworthy ones. BTW: Stop putting Javascript on s3.amazonaws.com as it forces me to enable Javascript for all of amazonaws.com. This is a security-hole waiting to be exploited. I already posted about this over a year ago when you first started doing this.

3) The fact that the advertised sites don’t belong to LL or some partner of LL doesn’t prove anything. Only a very, VERY stupid spammer would make it that easy for you.

4) We are not just talking about email-addresses here. We are also talking about RL-data associated with the email-addresses. In my case the spammer knew my RL-firstname. In one case reported by someone else it was the combination of an email-address used ONLY for SL and the full RL-name of the credit-card holder used for that account which was NOT identical with the user’s RL-name. I don’t see how any spyware could connect these two pieces of information.

In conclusion: Linden Lab, KEEP LOOKING!!! You are leaking this information *somewhere*.

Logically from the information given by one of those affected, the explanation given by the Linden Lab representative can not have occurred unless the Second Life payment site has spyware embedded in it.  One email was sent to an email address that apparently has only been used as the contact point between Linden Lab and the Second Life account holder, had not used elsewhere and the spam email had the card holder’s name, not the account holder.  The card holder is someone else and therefore the only place the matching of these two pieces of data could occur is Dragonfish.  The fact that card holder names are being used should have triggered alarm bells in Linden Lab.

The most likely scenarios are:

• Corruption.  The data has been accessed and removed by an unauthorised person/s  working for Dragonfish and has been sold on to other gaming sites for personal profit.

I feel this is the most likely scenario but only Dragonfish can confirm this by checking who has access to the data.

The other possible scenarios are:

• The emails came from other Dragonfish companies.  This means that Dragonfish is using the data without the knowledge or consent of those affected and in breach of the EU data protection laws.  Financial information (card holder name at a minimum) should never be used this way.
• Dragonfish is selling the data on to other gaming sites.  Again this is a breach of EU data protection laws.  Financial information (card holder name at a minimum) should never be used this way.

~~~

~~~

Here are the relevant links to make a formal complaint