Orange accidentally shared the email addresses of more than 300 customers yesterday during a bid to find out what they think of the company.
The email, passed on to us by several readers, suggests the recipient might like to reply with their thoughts about how customers keep in touch with the operator, along with any suggestions about how the service could be improved. Teaching staff the value of the BCC field might be a good start.
Apparently Orange is "intending to update and modify the 'Contact Us' section of the Orange website" and thus mailed everyone who'd recently used the page to get feedback on their experience. But, critically, it failed to hide the email addresses to which the message was sent.
Orange tells us that it's aware of the problem and is "looking at this as a matter of urgency".
Not that Orange is alone in hitting the wrong button: last June 416 Vodafone customers had the same thing happen to them, though Voda's customers were more vocal in their responses, which created a storm of messages as they all hit "reply to all". But the original message had been an apology from the operator rather than a request for feedback.
Given that most people using the feedback page are complaining, they are unlikely to be impressed by having their email address shared with everyone else. We did consider mailing them all to ask their views on this, but on reflection decided…no.
“Even if this may appear as a minor, unimportant happening on first sight – it is not,” comments Michael Struss, Sales Director at InfoWatch Central Europe, a company specializing on the protection of private and confidential data. “These are not the first data losses of major telecommunication providers and will not be the last, until appropriate measurements have been taken. Governmental regulations increasingly punish these kind of ‘blunders’ since we are talking about violation of private data. It is about time, that companies across the globe tackle the challenge of data protection.” Source
