How Toshiba dropped the ball and leaked my personal details on the internet (and those of 1,800+ others).

I bought a new Toshiba laptop last week. As part of this purchase I also got the opportunity to participate in Toshiba’s Rugby World Cup Competition whereby every point that Toby Flood scores earns me a £1 cash rebate.

We duly filled out the online form to enter the competition. On submission, we got an email containing a link to a Certificate of Registration.

toshibaregistrations.com/rugbyworldcup/Certificates/TOSH1500.pdf

The 1500 number in the URL seemed to be a simple incrementing integer. So we modified the URL by one digit to:

toshibaregistrations.com/rugbyworldcup/Certificates/TOSH1501.pdf

Instantly, the certificate (and personal details) from another customer came up.

This meant that, in a matter of minutes, I could have downloaded ever single one of the 1,850+ entries in Toshiba’s competition.

Immediately we contacted Toshiba about this data breach. And I’m only blogging about this now, because I didn’t want to publicise the security lapse. Toshiba have now acted and remove the PDFs.

However, now that the problem has been fixed, I feel that Toshiba’s relaxed stanch on data protection should be exposed.

What we don’t know

• Why Toshiba needed such personal data for this competition? e.g. - name, home address, date of birth, telephone number, model and serial number of laptop.
• Whether Toshiba will:
  • contact the customers affected and offer any compensation,
  • contact the Information Commissioner’s Office to report this breach, or
  • be able to tell whether customer data has been accessed by third parties.

Streetcar to Zip car offer is epic win for founder members

This is a follow up to an earlier post.

OK, I admit it. I was wrong. I’ve just got off the phone with Ben from Streetcar. Who tells me that I’ve actually paid £150 deposit. This was impossible for me to check as it didn’t show in my online account and I didn’t have any bank statements that far back. I was going to have to go trawling through old email logs to work this out.

Only founder members with a partner membership paid £225. Not sure what the deal does for them -  but for me, it’s all win.

• My full deposit turns into usable driving credit - so I’m not out of pocket.
• The credit does expire - but it’s nine months and I’m confident that I’ll use it in that time.
• Streetcar are giving me free lifetime membership to Zip car - what’s not to like?

With this all clarified, you’d be a fool not to take up the offer.

Streetcar ultimatum #3 to loyal founding members

Update: Read this follow up post - offer actually turns out to be epic win.

Today I received the following ultimatum from Streetcar:

As one of our Founder Members, your support has been crucial to growing our car club. Last year we joined forces with Zipcar to create the world’s leading car club and very soon the best-of-both services will be launched under the Zipcar name, giving you access to more cars and vans across the UK and North America. As one of the first to embrace the car club concept in London, I would now like to warmly welcome you to Zipcar.

As a reward for your loyalty and custom over the years, we’re inviting you to convert your Founder Member deposit to free lifetime membership of Zipcar and driving credit of £150 (valid for 9 months) to get you started. To take us up on our offer please reply to my team by 22nd September 2011 and they’ll activate your new account. By accepting the offer your deposit will no longer be refundable and will be exchanged for Zipcar lifetime membership and £150 driving credit.

If for some reason you decide not to take us up on the offer of lifetime membership, you may switch to become a standard member paying an annual fee and have your deposit returned upon your switch to the standard membership. The two billing systems will be moving over to one shortly, so we can only hold this offer until 22nd September 2011. Please let us know either way by then.

These “special offers” have started to come out once a year. This one in particular is very disingenuous. For starters, the deposit that I paid to Streetcar four years ago, that they’ve been earning interest off (ok, admittedly not much now)  - was for £250.

So in effect, Streetcar are taking £100 of my money to keep the status quo… or rewarding me, to use their words.

I really like Streetcar - they have an excellent service, however I find these ultimatums very dishonest. They don’t even mention the deposit stake that you’ve paid to them. I only learnt that it was £250 (not £150 as I’d assumed) from a tweet. And taking £100 from my deposit in return for the status quo is not a reward - it’s a penalty.

I’ve received other offers like this from Streetcar in the past. In 2010 and 2009 I had similar offers like this one.

In 2009, you received an offer from us to convert your membership type from Founder Member to standard Streetcar Member. We didn’t hear from you at the time and just wanted to let you know that the offer still remains open to you now.

To recap on the offer:

Convert to an annual membership

Receive £200 in free driving credit (valid for 9 months)

Start paying annual membership fees after 2 years (currently £59.50 per year)

We’re also adding in an alternative option:

Receive £250 in free driving credit (valid for 9 months)

Start paying annual membership fees after 1 year

Remember that if you do take either option, were you to leave you would no longer receive a refund of the deposit you paid when you first joined.

None of these options is particularly appealing.

Truly extraordinary speech by fearless West Indian woman in face of Hackney riots

Sums up everything nicely. She’d get my vote.

via @GarethAveyard