Rap for wrap chaps in crap email trap: Chipotle HR used domain it had no control over

Excuse me. Is this where I register my E.Coli fecal sample?

I have the brown stuff on a stick and want to know how I can send it to you.

Obviously, Chipotle takes "privacy and security very seriously" since they didn't care enough to even respond to Mr. Kohlman. Another group of wankers running a corporation I see.

Big software company, one you know

Built a whole huge test dataset using real employee data, but with their email addresses set to <username>@bogus.com, and routed through the real live exchange servers.

I pointed out that the poor buggers who owned bogus.com, A REAL DOMAIN, must be getting pissed with receiving 80,000 emails a day containing PII for our employees, and we should only hope they're ignoring the huge volume of mail from us as spam rather than using this data. Faces went white, and quite quickly we set up the equivalent of devnull.thecompany.com sub domain, but for a while we sprayed PII all out over open interweb directly to someone.

This was a very high tech company you know, they should have known better. In retrospect, they really owe me for pointing that out!

A former sales manager was writing an email to a female contact in another company, but couldn't remember the domain name of the addressee. He put in the "first.lastname@" for the lady, and used "xxx" as a placeholder for the domain in front of the .com, intending to replace it when he recalled the information.

When done composing the email, he hit send without thinking. That set off a firewall alert and a meeting with HR soon after.

Everyone involved believed him when he told the story as the email in his sent box was completely professional. We all had a great laugh after he'd left the conference room red-faced.

I fear their chimichangas have lost much of their crisp.

Obviously not a real address

Since the early days of email I have had an email address of "wibble@<wellknowndomain>.com.

Every few years some bright spark decides that having finally discovered Black Adder they have thought of the perfect test email address.

I then get a flurry of emails, until I contact them and point out that I know what they are doing.

Only ever had one apology/admission of guilt. Usually get "we have fixed the problem" if I am lucky.

El Reg Muppet company list

Maybe El Reg should have a have a scorecard system of Muppet Run Companies.

The list downloadable as say CSV for the better amusement of readers who want to "further process" the idiocy.

Not exactly the same problem, but similar

I work for a mid sized e-commerce company (that will remain nameless). A few years ago I received a phone call from the manager of a small company asking if I know why they are getting flooded with calls asking for our company. Customers were calling thinking they were getting our customer service department. After a few days of head scratching, we still couldn't figure out why our customers were calling them?

At this point, I called the manager back, and asked them to ask one of the callers where they got the phone number. The customer answered that it was printed in a big numbers on their pick-ticket (invoice) that was in the box. It turns out that someone here just used 1-800-(company name) on the pre-printed forms. The problem was, that wasn't the correct toll free number. We had sent out tens of thousands of orders with this printed on the pick-ticket.

Nobody ever admitted to being responsible for this. Fortunately for us, the owners of the poor company that kept getting slammed with calls was very understanding. We gave them and their staff codes for some huge discounts on our products, and everyone just laughed it off. Being the US, I was really surprised we didn't get sued! It says a lot for the owners of that company.

The tragic tale of foo :)

http://bar.com/

Monthly Bail Bonds

An online bail bond company set up at almost the same address as our personal domain but with an s. ( We were here first!) About once a month we get people emailing copies of every single piece of personal information to our info@ address when applying for their custom bonds. If we were malicious we really could steal their identity with no problems at all.

PHB hiring the 16 year old nephew/niece

Is the result of the PHB hiring their 16 year old nephew/niece who can turn on computer but not much else?

intranet pr0n

A former employer once decided to make up a random domain (based on the company initials) to house part of its intranet. Not a problem if you were browsing on the corporate network as the DNS would resolve it. But I once clicked on a link in OWA and to describe what I found as NSFW would be an understatement! It took hours to discover all the filth on there...

Not email but worth a face-palm

A company I worked for recently hired a 'professional' hacker to test employees using a phishing campaign. He got a few hundred employees from LinkedIn and correctly guessed their email addresses (firstname.lastname), and sent a link to a fake Outlook Web Access 'test' page using an almost-exactly-the-same-but-not-quite-the-same-as-the-company's domain name he'd registered.

Good stuff: he speared quite a few clueless peeps, *but* he'd actually taken the OWA logon page from an unconnected legitimate company's website, and left the redirect to the failure page pointing to their original domain. So he ended up bouncing persistent employees into trying to log into an innocent third-party's email system, using their internal domain usernames and passwords. What a pro!