Does allakhazam sell our e-mail addresses? (was forum=21)Follow

Oh and I forgot to add, if you ever get an email that you are not sure about and you'd like one of us to check. Kaolian and I would be more than happy to assist you so that you are safe! We also have a computer help section on the forums as well.

Interesting. Last week I also received a couple emails about someone initiating a password reset on my battle.net account. In response I decided to change the email associated with my battle.net acct, change that password as well as the one for that email, and add an authenticator to my battle.net acct. Perhaps I overreacted :P.

I have no idea though if this actually came from someone who acquired my email through this site. It is the email associated with my account here, but I use the same account for most of my website signups. =/

Its funny, because I got an email about a Faction Change from Blizzard. The funny part is I didn't use the same email for battle.net that I do for Zam. Not only that, but I haven't played WoW since before the linking of battle.net to emails and accounts and whatnot. Then you have the fact that I gave my account away to a friend of mine, and since then they've deactivated the account. The long and short is that there really is no way I could have gotten an email about my Faction Change unless it were some sort of phish, and I hate to accuse, but Zam is the only place I use the lolgaxe email address at. I'm not saying you guys sold it, of course. I've got enough faith in you guys to realize you wouldn't be that retarded.

I still have the email in my deleted folder. I could forward it, for what its worth.

I got two more phishing emails to my allakhazam account today, one "Blizzard Store Order - StarCraft II: Wings of Liberty" with a fake link asking me to sign in to my blizzard account, and also "Blizzard Entertainment Cataclysm Beta" directing people to login to battle.net at worldofwarcraft-cataclysm-beta.net (which is now down).

I have no vested interest in Allakhazam, I just wanted to share this information to help others avoid this issue, and to tell Allakhazam staff of this potential breach of information. The fact 2-3 other people with allakhazam specific throwaway emails also got spammed and happened to see my post tells me at least that there seems to be a common thread.

If I were to put money down, I think you do have a breach of information somewhere. It just takes an unvalidated string input in a web form for someone to extract data they shouldn't be. I think it is also irresponsible to take the attitude that "it can't happen to us". Scams like this cost people time and money, and if you have been breached it'll happen again if the holes are not fixed. It seems to me you owe your users a security audit to make sure you're not leaking their data out onto the internet.

Good luck to you all.

Edited, Aug 2nd 2010 3:48pm by anklebyter

Trust me, they really covered their bases here.

Yep, I got that first one also. Not the second one but that's probably because their little operation was shut down quickly.


I've also been posting here many years and I've never gotten any kind of spam or phishing e-mail or anything unwanted to my Allakhazam-linked e-mail. The fact of the matter is that something is happening NOW, within the last week or so. Several of us have confirmed that we're getting these e-mails because the e-mail address is linked to our Alla accounts and to no other sites. Telling people to simply spoof an e-mail or use throw-away e-mails doesn't help the thousands of users who likely use one primary e-mail address for most things; it's these people who are vulnerable to being phished, they're the ones that aren't security-savvy and assume they can just use their primary e-mail on this site, Blizzard's site, etc., because they assume all of these sites to be 100% safe.

There's obviously a leak or some sort of vulnerability. As a long time visitor of this site, I see it as a big problem and I'm trying to raise awareness to PROTECT the site and its visitors. Pointing fingers away from Alla and absolving them of any vulnerability isn't going to help, it's only going to prolong the problem. It's actually kind of sad that a lot of you are trying to dismiss it and insist that Alla is an impregnable fortress and that we're somehow at fault for getting the exact same phishing e-mails every other day on e-mail accounts we ONLY use for THIS site.

I don't play WoW. Haven't had a battle.net account in over a decade. These phishing e-mails don't affect me at all, so why should I care? Maybe it's because no one deserves to be phished by linking their e-mail address to possibly the best MMO-oriented site on the net. And, because I want to see this problem nipped in the bud and Alla's reputation as a safe site kept in tact.

I got a WoW Faction change phishing e-mail last week, from an e-mail that is different from the one I use for Alla. That suggests rather strongly that Alla is not the address source for that particular phishing e-mail.

Amusingly, I don't play WoW, so I wasn't terribly concerned that I had changed factions.

When was that? =o

The obvious answer is to find the email adresses used by all of the admins, and then deadmin them all at once

Bring 'em on! I've got 22 gigs of inbox space and a spam filter than has catched every spam mail yet.

Thanks for getting to the bottom of it. I'm relieved to hear that the issue was uncovered and addressed, despite "certain people" being very dismissive of the potential of a problem.

Edited, Aug 5th 2010 5:20pm by Eske

Just to report.

I have received phishing email to the email account that is registered to battlenet.

I have not received phishing email to the email account that is registered to this website.

Both are very old accounts.

Since the WoW phishing e-mails have started, I have deleted over 200 from my e-mail account all of which is being 'sent' from my Zam registered e-mail address. It's gotten a bit ridiculous and I don't see it ending any time in the future. Not happy.

Em