Bass Pro Shops: Selling Sporting Gear to a Stolen Email Database
Well, I had meant to post this about a week ago, but see that Spambouncer beat me to the post. I do however need to add to this situation as
- It does involved the sending of spam to a stolen email address (mine)
- Per Spambouncer’s post I see that even though I’ve already notified the ESP Cheetahmail, a division of Experian weeks ago that this was occurring they still haven’t taken action on the customer and or the list.
What I need you to know is that the email address being used in this spam attack on me was a tagged address that my spouse and I gave to Home Depot when we purchased a new Washer and Dryer from them. The tagged address naming convention correlated to the brand name we purchased. Less than a year after we gave the email address we began to receiving vulgar spam messages to it. We did try to contact Home Depot about this matter, but they ignored the calls and emails we submitted to them. Over all, Home Depot has a security breach somewhere, but refuses to acknowledge it. Anyways, I’m posting BOTH spam message this tagged address received.
————————
Spam 1:
Sending IP:142.54.200.35
From: Bass Pro Shops
Subject: Don’t Miss Out on Special Offers and Events from Bass Pro Shops
Date: November 13, 2011 12:47:08 PM CST
To: REDDACTED
Received: from dmx1.bfi0.com ([142.54.200.35]) by REDDACTED (mail.REDDACTED) with ESMTP id REDDACTED.msg for ; Sun, 13 Nov 2011 13:19:46 -0600
Received: from [10.150.20.118] ([10.150.20.118:36613] helo=dlspvhcimailer18) by dmx1.bfi0.com (envelope-from ) (ecelerity 2.2.2.45 r(34222M)) with ESMTP
X-Mdremoteip: 142.54.200.35
Dkim-Signature: REDDACTED
Domainkey-Signature: REDDACTED
Mime-Version: 1.0
Special offer to you – $10 Bass Pro Shops Gift Card with your next order of $50 or more!
Fall is here and it’s time for your next outdoor adventure!
As a valued customer, you’re invited to take advantage of exclusive email offers, sales, events and more!
To welcome you, we would like to extend the following offer on your next online purchase.
$10 Gift Card with your order of $50 or more!
Enter promo code REDDACTED at cart.
Hurry, offer ends November 20, 2011.
Like us on Facebook
Follow us on Twitter
Visit our Blog
Enter promo code REDDACTED at cart. Offer valid through November 20, 2011.
You can also order by calling 1-800-BASS-PRO (1-800-227-7776). Give the Phone Representative Key Code L1EF.
Offer applies to Internet and Phone orders with merchandise total of $50 or more. Not valid in the retail stores.
Purchased gift cards and redemption of rewards points will be deducted from qualifying merchandise total.
Excludes applicable taxes and shipping charges.
Cannot be combined with any other offers. Not valid on previously placed orders.
Descriptive, typographical or photographical errors are subject to correction.
Bass Pro Shops
2500 E. Kearney
Springfield, MO 65898
If you do not wish to receive future emails from Bass Pro Shops, click here
View our privacy policy.
Copyright © 2011 Bass Pro Outdoors Online LLC, All Rights Reserved
————————
Spam 2:
Sending IP: 8.7.43.150
From: Bass Pro Shops
Subject: 5 Hours Only – Huge Savings In Store Tomorrow
Date: November 24, 2011 4:15:44 PM CST
To: REDDACTED
Received: from mta932.basspronews.com ([8.7.43.150]) by REDDACTED.com with ESMTP id REDDACTED.msg for ; Thu, 24 Nov 2011 16:15:35 -0600
X-Mdremoteip: 8.7.43.150
Dkim-Signature: REDDACTED
Domainkey-Signature: REDDACTED
Mime-Version: 1.0
5 Hour Sale – starts Friday at 6am at your local Bass Pro Shops View this email with images
Like us on Facebook
Follow us on Twitter
Visit our Blog
ShareThis
5 Hour Sale prices are valid at your local Bass Pro and may not be valid online or by phone.
Prices not valid in Branson, MO; Miami, FL; Islamorada, FL; Rocky View, AB; and Toronto, ON.
Prices shown are in U.S. funds and are subject to change.
Descriptive, typographical or photographical errors are subject to correction.
Bass Pro Shops
2500 E. Kearney
Springfield, MO 65898
Update your email preferences.
If you no longer wish to receive our email newsletter, click here.
View our privacy policy.
Copyright © 2011 Bass Pro Outdoors Online LLC, All Rights Reserved
Sender Relations — the first spam sample above is not via Cheetahmail/Experian, but via Bigfoot Interactive/Epsilon Interactive. Otherwise…. This is interesting. You’re sure that Home Depot didn’t have any weasel wording indicating that they shared their database with “partners”? Since Home Depot didn’t see fit to communicate with you, that does seem to indicate a stolen or sold email database.
If it was stolen, Bass Pro probably wasn’t aware of that when they purchased the list. But sending bulk email to a purchased list is spamming by definition, even so. :/ Cheetahmail really should shut down the Bass Pro mailings til they can figure out what happened and fix the list. I wish I were confident that they would.
yes, your right. I messed up in posting the wrong spam sample for this post. I have multiple ones now from Epsilon and NOW Cheetahmail/Experian.
Did Epsilon let them go or did they have two different ESP’s to spam from? Interesting of the latter?
I recall the visit to Home Depot asking them for a privacy policy and NO where did it state sharing of a DB.
Bloody hell. This shop hit one of our spamtraps at work too, and the nearest Bass Pro Shop is, I believe, about 5000 K distant and across a rather large pond. Nothing at SH yet, but I am watching.
I found out that the email address came from this list broker http://www.cdmlist.com/contact.asp. I’ve submitted a ticket to them asking where they got my tagged email address from
Interesting. Several of the spams that I’ve blogged about also involved purchased lists from a number of brokers, including some big names. Perhaps it is time for a blog about purchased lists and the companies that sell them. :/
A Cheetahmail representative monitors this blog, or (rather) was monitoring it when it started. (Most large ESPs seem to have somebody monitoring the blog.) I hope they use this information to good effect. It is doing Bass Pro’s reputation no good to be known of as a spammer, and it isn’t helping Cheetahmail’s reputation to have a spammer as a customer either.
Gents, I’m president of the list company mentioned in your blog. In regards specifically to this, 1) Bass Pro Shops was notified of this blog on Monday 11/28 by Cheetahmail/Experian who does the distribution of their normal email advertising. 2) the distribution of further advertisements to the “list” in question was discontinued at that time pending further investigation. Indeed both Bass Pro nor Cheetahmail need not be spamming and they are well aware of the consequences of doing so.
The “list” in question is not a rented list, it’s Bass Pro’s customer file that we had appended with emails by Epsilon, which our company organized. We have researched and found 1) Sender Relations has purchased from the Bass Pro store in Dallas (Grapevine). 2) When sending Sender Relations name and postal address to Epsilon their database had a match with an email address. 3) All of the initial email appended records received a BPS welcome type email (sent by Epsilon), which offered the customer a coupon or allowed them to opt-out. Once that project was complete the remainder of the records were sent to Cheetahmail with the intent of those customers to begin receiving scheduled promotiions.
Epsilon key punches warranty cards data for numerous manufacturers. LG happens to be one of those manufacturers. Epsilon has 3 different products registered to Sender Relations for LG products and one to an outdoor power equipment company. Those products might have all been purchased at Home Depot, but those registrations have nothing to do with HD.
Epsilon, the division that key punches warranty card information, and the former companies that did this prior to Epsilon purchasing them, have been doing this for many years. They know the questions to include on the warranties and once put up for the manufacturer they also get to use the data for marketing purposes. The end result of the investigation found the email in question was entered on the warranty card for the 3 LG products, the outdoor power equipment product that was purchased, and the opt-out from receiving future advertising was not selected. I’ve been assured Sender Relations email and record has been removed from their file and no new orders will include that record.
I hope this sheds complete and accurate response to the situation. No doubt all involed cannot afford to be taggeed as spammers. We need to do whatever necessary to exonerate and clear the names of some very large names in the direct marketing industry. What other questions might you have that I missed?
Welcome to the blog, MCHIL. 🙂 Before everybody starts picking on you, I wanted to thank you for a clear description of the process that led this particular email address to be placed on Bass Pro’s list. I’ve been working as an anti-spammer for well over a decade. I’ve deduced the path by which email addresses ended up on lists, and have seen explanations by companies and by ESPs, but not by somebody who does e-pending and other list services. This was helpful.
As you probably knew coming in here, you are facing a hard sell to a fairly hostile crowd to justify e-append. Most of us consider e-append services to be spam support by definition, and email sent to e-appended lists to be spam. I certainly do. I don’t consider purchasing a product from a company equivalent to giving them permission to place me on a mailing list, even if I provided them with an email address to complete the transaction. If the company uses an e-append service to find an email address that I specifically did not give them, that’s a double strike against them. I consider that sort of behavior both a violation of my privacy and a failure to respect the boundary that I set by not providing them with an email address. On the few occasions that this has happened to me and it involved a company that I had actually done business with, I quit doing business with that company.
However, in this case it sounds as if you were open with both Epsilon and Bass Pro about the service that you were offering. You did not sell them a list under false pretenses. So they bear full responsibility for their part in the spam run, and at least for the spam sent to Sender Relations’ email address.
As you probably noticed, I blogged about this same spam incident. Bass Pro also hit one of my spamtraps, an email address that closed many years ago. I can’t be sure that this particular email address was one of those supplied by Epsilon, but it receives a considerable quantity of mainsleaze spam and appears to be on a number of lists. This is despite it having rejected email at SMTP time for over three years.
My spamtrap is exactly the sort of email address that tends to get picked up by e-pending services, and has been in other cases. It was used in public forums, so list providers of all kinds have it. The owner also (foolishly) provided it to companies to complete online transactions instead of opening a throwaway account at a free webmail provider, as a more cautious and savvy end user often will do. The previous owner closed it (not surprisingly) because she was receiving so much spam, not just from companies she’d done business with but from companies that she had never heard of.
It’s as good an illustration as I have of why opt-out of any type (be it e-pending, list sales, or simply adding all customers to a list til they tell you to stop) is destructive to email. It ignores boundaries; it refuses to respect limits. Users are left with no option but to ask each individual company to remove their email address from lists. That doesn’t work; there are simply too many companies and people who spam, even those that will respect an opt-out request. With all my knowledge of how email works and all of the nearly-paranoid measures that I take to protect my private email address, and with its presence on lots of lists of “email addresses that should be suppressed automatically”, I would still not be able to use that email address except for the industrial-strength spam filtering I do. Most users do not have my tools to deal with the onslaught.
I believe that what you do is contributing materially to the problem. I wish you would stop.
As of a few days ago, Bass Pro started hitting the same spamtrap of mine that it emailed before “fixing the problem” reported in this blog. I don’t know whether they resurrected the bad mailing list, after listwashing Sender Relations from it, or purchased a new list that happened to have the same email address on it. But this *really* stinks to high heaven. :/