Update: Likely Data Security Breach at iContact.com

On the day I posted Suspected Data Security Breach at iContact.com I was contacted via Facebook by someone with an email address @icontact.com. I forwarded them the same information that I sent to their abuse team. I’ve not heard anything back since.

Others have picked up on this likely breach at iContact.com:

• Joshua Baer on the deliverability.com blog
• Laura Atkins on the wordtothewise.com blog
• @sandheepks on Twitter

iContact have answered some concerns: they are looking into the problem.

I have been contacted by one of the sites/services whose address-list has been breached, simply to ask to be kept in the loop with iContact.com’s response.

I have done some further research into my mail folders. I have found one address which iContact.com have on record which has not yet received any spam. As a result, this address hasn’t been compromised and has been replaced by HIDDEN on this public website. iContact’s abuse team has been provided with the full details, however:

Received: from smtp7.icpbounce.com ([::ffff:216.27.93.119])
 by faelix.net with esmtp; Tue, 01 Jan 2008 01:12:36 +0000
 id 000013C1.47799384.00003B72
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
       by smtp7.icpbounce.com (Postfix) with ESMTP id 43D6197750
       for <HIDDEN>; Mon, 31 Dec 2007 19:54:34 -0500 (EST)
Date: Mon, 31 Dec 2007 19:54:34 -0500

This address hasn’t received any emails this month:

mail:~# ls -l /var/log/mail.log*
-rw-r----- 1 root adm  9351785 2010-01-28 11:45 /var/log/mail.log
-rw-r----- 1 root adm 13870643 2010-01-24 06:23 /var/log/mail.log.1
-rw-r----- 1 root adm  1451508 2010-01-17 06:24 /var/log/mail.log.2.gz
-rw-r----- 1 root adm  1257403 2010-01-10 06:24 /var/log/mail.log.3.gz
-rw-r----- 1 root adm  1828195 2010-01-03 06:25 /var/log/mail.log.4.gz
mail:~# zgrep HIDDEN /var/log/mail.log*
mail:~#

The last email sent to this address was via iContact.com on 17th July 2009:

Received: from smtp15.icpbounce.com ([::ffff:216.27.93.111])
 by faelix.net with esmtp; Fri, 17 Jul 2009 23:30:51 +0100
 id 000010FE.4A60FB9D.000039C9
Received: from localhost.localdomain (localhost [127.0.0.1])
       by smtp15.icpbounce.com (Postfix) with ESMTP id D37AA6A0C98
       for <HIDDEN>; Fri, 17 Jul 2009 18:01:58 -0400 (EDT)
Date: Fri, 17 Jul 2009 18:01:58 -0400

Timeline

March 2002

photonlight@maz.nu receives its first iContact.com mail

1st January 2008

HIDDEN receives its first iContact.com mail

7th Feb 2009

macheist.com@maz.nu receives its first iContact.com mail

1st April 2009

macheist.com@maz.nu receives its last iContact.com mail (address now blacklisted)

2nd April 2009

bloomsbury.com@maz.nu receives its first iContact.com mail

14th May 2009

slimes@maz.nu receives its first iContact.com mail

17th July 2009

HIDDEN receives its last iContact.com mail (address still valid)

27th July 2009

bloomsbury.com@maz.nu receives its last iContact.com mail (address now blacklisted)

30th December 2009

photonlight@maz.nu receives its last iContact.com mail (address now blacklisted)

18th January 2010

slimes@maz.nu receives its last iContact.com mail (address now blacklisted)

At first I wondered if the anomalous address, HIDDEN, was an indicator that perhaps only addresses recently sent a newsletter by iContact.com had been breached (i.e. those contacted after 17th July 2009). The counter-example is macheist.com@maz.nu which has been receiving emails only via Google’s mailers since April 1st 2009, so that theory doesn’t hold water. However, it would appear that not all of my addresses on file at iContact have been spammed yet, so perhaps this isn’t a total breach… or perhaps I’m still waiting for HIDDEN to be hit!