Marketing Firm Exactis Leaked a Personal Info Database with 340M Records

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by axaxs on Thursday June 28, 2018 @11:32PM (#17422197)

That's the depressing part. I usually shop at Meijer because they were the last grocery left without annoying loyalty cards. As of this year, I've began receiving in the mail coupons for specific items I'd bought there. So either my credit card company has sold my data, or it was 'stolen' when they scanned my license to buy beer at some point(they require scanning the license, not DOB entry). I'm tired of this.

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by patrickg_zill on Thursday June 28, 2018 @11:43PM (#17422230)

The credit card info is called "level 3 data" and they in some cases have line item by line item detail. Not just "spend $24.89 at Meijer store #349" but each individual thing, e.g. you bought 2 avocados.

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by dizzant on Friday June 29, 2018 @12:19AM (#17422389)

Is this data available to mortals? I don't even have digital itemized receipts for credit card purchases, and it's my purchase!

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by propogandist on Friday June 29, 2018 @12:50AM (#17422496)

Mastercard and Visa [1] sell this data in aggregate to firms via brokers like Bluekai, to allow for ad-targeting.

I don't believe it'll be feasible to purchase just one person's purchase data [easily], but if you knew who you wanted to get to, it should be possible to narrow the targeting to get to them

[1] http://www.oracle.com/us/solutions/cloud/data-directory-2810... [ctrl+F + mastercard]

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by discordance on Friday June 29, 2018 @01:36AM (#17422626)

Wouldn't a GDPR request to Visa or MasterCard in the EU get me this data?

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by black_puppydog on Friday June 29, 2018 @02:26AM (#17422777)

That's what I was thinking. Would be awesome for personal budgeting...

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by namibj on Friday June 29, 2018 @05:54AM (#17423522)

Well, they have to provide it digital, if they already have it digital. So yeah. Anyone wanna integrate the format they can deliver with e.g. GNUCash or so?

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by greglindahl on Friday June 29, 2018 @12:30AM (#17422427)

How does this work with Apple Pay, which doesn't tell the retailer who the consumer is? Does the retailer sell the info, or the credit card company?

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by macintux on Friday June 29, 2018 @09:40AM (#17424436)

Wondered about that too. Apparently Apple Pay does use the same artificial CC number with each payment (maybe only with the same merchant?) so it's still possible to have your purchases tracked over time, even if they don't know who you are.

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by bb101 on Friday June 29, 2018 @08:02AM (#17423972)

I wonder if the credit card companies have access to line-item level 3 data if we use ApplePay?

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by jimjimjim on Friday June 29, 2018 @04:04AM (#17423114)

usually there is only space for group ids of items rather than individual item details.

but i guess it might be different for different acquirers.

the purpose of loyalty cards is that the messages are usually acquired or processed on non-bank systems so they can go into much greater detail and include individual sale item details

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by axaxs on Thursday June 28, 2018 @11:56PM (#17422290)

Is that recent? I just started getting it this year. Is there a way to opt out?

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by patrickg_zill on Friday June 29, 2018 @12:08AM (#17422343)

From what I know, it started a few years ago; but not all big stores had the equipment in place to send it (the cc processors give them a discount for sending the line-item level 3 data).

With the advent of the chip and pin cards in the USA, it seems logical that just about everyone upgraded to equipment that does support it; which might explain why you are only seeing this in the past year.

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by axaxs on Friday June 29, 2018 @12:18AM (#17422386)

So, this seems a little opposite of what I meant. Naive me always assumed I pay with a card, the store gets my cc info to charge and we part ways. I'm getting in the mail ads from Meijer, for items I buy frequently. This tells me they were able to extract my home address and name from my credit card. Is that accurate?

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by 18pfsmt on Friday June 29, 2018 @11:36AM (#17425102)

I worked for the largest merchant acquirer ~11 years ago, and we were collecting SKU-level data for Wal-mart at that time.

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by thelastidiot on Friday June 29, 2018 @12:59AM (#17422517)

Yes, these data are all available, if you are willing to pay to get those.

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by lotsofpulp on Friday June 29, 2018 @10:15AM (#17424620)

I noticed that now when my employees buy from staples.com, my AmEx statement will show everything they bought. From a manager's perspective, it's kind of awesome because you don't need to keep track of little receipts.

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by mulmen on Friday June 29, 2018 @04:14AM (#17423149)

I have no problem with loyalty cards. It helps the store work more efficiently and sell me more relevant products. I have a problem when the loyalty card is tied to my identity and any data from anywhere else.

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by fencepost on Friday June 29, 2018 @12:26PM (#17425471)

I usually shop at Meijer because they were the last grocery left without annoying loyalty cards.

(quizzical look)

Are you aware of their MPerks program? Tied to your phone number and an email address, electronic receipts, tracking of your savings, online/in-app clipping of coupons auto-applied at checkout time, automatic "rewards" of $2-3 for every $150 you spend.

The only part of a traditional loyalty card program it doesn't have is making their sale prices apply only with card, but it definitely gives you measurable (and measured) discounts both passively through those "rewards" and actively via the in-app coupons.

[ Parent | on HN ]

Re:Marketing Firm Exactis Leaked a Personal Info Database wi... by axaxs on Friday June 29, 2018 @12:30PM (#17425498)

Yeah I'm aware. I am not signed up for them. That's the reason I don't like Kroger, their stuff is way marked up without a card. That said, I figured out a 'trick' of just asking for a card and saying you'll fill out the application at home. Doesn't seem like such a trick now since they're all just tracking me by my payment methods. Oh well.

[ Parent | on HN ]