Some new boy put in front of a PC and told to get on with it.

Most organisations don't train their staff properly.

CC and BCC should not be a choice when sending a group email -- the software should be configured so that mass-email CC is impossible.

Those email addresses should have been in a database. There should have been a method for mass emailing people in said database (web form?). Nobody other than the techies maintaining that database should have direct access to the list of email addresses.

Maybe the guys at PGP don't care about protecting their customers personal data. Even people *within* the company should be prevented from accessing customer data that they don't *need* access to.

that is all

...with a company my dad had inquired with regarding some engineering app or another. It resulted in an utter uproar of pissed off engineers firing messages back and forth: somehow, all mails back to the company, even without 'reply all', got cc'd to the original list.

So the first round involved indignant responses to the company; the second involved angry rejoinders from people who got the first round and thought it was the fault of the first responders; the third involved both the peanut gallery submitting wry comments and others yelling for everybody else to STOP SENDING EMAILS ALREADY...

Apparently it was a pretty fun day.

and are doing what we can. I have posted a comment at:

http://blog.pgp.com/index.php/2009/03/email-marketing-gaffe/

Regards,

Jon Callas

CTO/CSO

PGP Corporation

...ISPs and most commercial mail server implementations don't have a limit on the number of addresses in the TO/CC field (e.g., more than 200 and it bounces back saying "please use BCC" or something.

As one of the people who received this email,to say I'm NOT amused is putting it mildly.A security company that seems to have no idea about security.................. it's a joke!

First of all, may I say I am impressed with your speedy and honorable response to the matter.

It's rare indeed that we see such candidness.

Secondly, I would like to say this might be an embarresing incident for yourselves, dashed with more than a little irony, but that I have seen much, much worse gaffes, from organisations and individuals who should have known much better.

At least it was only a harmless marketing email. Anyone got the latest tally from the MOD?

290 email addresses Vs 600,000 peoples passport details, NI numbers, family details, medical records...