Glassdoor email gaffe exposers users’ email addresses

So Glassdoor updated its terms of service, and dutifully notified its users by putting all their email addresses in the TO: field.  Yeah, you read that right.

And no one apparently noticed before hitting SEND.

Leading to a second email later today:

Dear Glassdoor User:

Earlier today we inadvertently exposed your email address to other
recipients during a routine e-mail distribution regarding changes to our
Terms of Use.

We are extremely sorry for this error. We take the privacy of our users
very seriously and we know this is not what you expect of us. It certainly
isn’t how we intend to operate.

If you have any questions, please contact us at [email protected].

Sincerely,
The Glassdoor Team

Thanks to Jeanne Price for letting me know about this one. I wonder whether anyone hit reply-all as that would have been quite a storm. 🙂

Update: The number affected may be on the order of 600,000.

About the author: Dissent

8 comments to “Glassdoor email gaffe exposers users’ email addresses”

You can leave a reply or Trackback this post.
  1. Donna - July 25, 2016

    So I got won of these apology emails, but what does this breach mean?

    • Dissent - July 25, 2016

      Not much, actually, except that depending on whether you used a tagged/throwaway email address with them, you might start receiving more spam or phishing attempts.

  2. Javier - July 26, 2016

    What a coincidence, that right after I get this message when logging into Glassdoor:

    “We have temporarily disabled your account. We have identified that your password matches one you have used on an unrelated website that has experienced a security breach. Please ​reset your password here.”

    So they screwed with their own security and now try to blame some fictional 3rd party website (how would they know what password I use in that unrelated website? how would they have access to that information? Just tell me which website had that breach, I will decide whether to change my password)

  3. Fulano De Tal - July 28, 2016

    Javier, I got the same message. Seems to me like if they wanted to be helpful they might actually name the “unrelated site” instead of leaving that account wide open.

  4. Anonymous - July 29, 2016

    I also got the email We have temporarily disabled your account. We have identified that your password matches one you have used on an unrelated website that has experienced a security breach. Should I be concerned?

    • Dissent - July 29, 2016

      Were you notified by the “unrelated web site,” too? If not, yeah, you should be concerned enough to insist Glassdoor tell you who the other site was so you can contact THEM and ask them what data of yours were compromised, etc. And if you used the same login credentials at a third or fourth or fifth site, better change all your passwords.

  5. Jim - August 2, 2016

    Can someone forward me the email?

    • Dissent - August 2, 2016

      No, because I remove email addresses from submissions. I posted the notification email in the story itself.

Comments are closed.