Check it out - http://www.msnbc.com/news/840596.asp

:)

Damn, I'd like to see some panty & bra sizes with names and addresses :D

i dont see anything

:confused: :eek:

Nov. 27 — A glitch at the Victoria’s Secret Web site allowed customers who purchased items there to view other customers’ orders in some cases, MSNBC.com has learned. On Friday morning, part of the site was shut down while company officials investigated. Personal financial information, such as credit cards, were not exposed by the glitch — but details of customers’ intimate purchases were.

THE GLITCH STRUCK a feature at Victoriassecret.com that allows customers to check the status of their orders. Before that feature was turned off on Friday, the unique number assigned to each customer was revealed in the Web browser’s address Window. A browser could simply change the customer number, and in some cases, pull up another customer’s orders.
Officials at Limited Brands Inc., which owns the Victoria’s Secret chain, shut down the “order status” feature immediately after receiving a description of the bug from MSNBC.com.
“Customer security is always a primary concern,” a company spokesperson said. “We have disabled the function referred to and are currently investigating.”
There are some mitigating factors for those who might be worried that their intimate orders were viewed by someone else. The glitch only allowed an Internet voyeur to pull up random orders; there was no way to search by individual name or geographical region. Also, it appeared only some customers’ orders could be viewed by altering the customer number in the Web browser’s address field — and it wasn’t easy for current site customers to stumble onto other customers’ numbers.
Advertisement

Customer numbers assigned by the site on Tuesday had 8 digits, while the glitch appeared to apply only to customers who had been assigned 9-digit numbers, and the numbers were not in series. That makes it almost impossible to stumble on exposed records by accident.
But they were easy to find if someone supplied explicit directions, which Jay Sudowski did for MSNBC. Sudowski is Director of Technical Operations for Handy Networks, a Web hosting provider in Colorado.
Starting with customer numbers supplied by Sudowski, MSNBC found large chunks of orders which were viewable — for example, hundreds of orders placed on Nov. 6 could be viewed. And the glitch seemed to cover a sizable amount of time, with some viewable orders dating back as far as June.

Once an appropriate customer number was discovered, a voyeur apparently could view all orders placed by the customer recently. Each order record showed what was purchased, including color and size, price, and the customer’s name and address. Other private information, such as credit card numbers, couldn’t be viewed, however — anyone attempting to view those were confronted with a user name and password request.
The company didn’t immediately know why some orders were revealed while others weren’t, according to the spokesperson, who said the order status feature wouldn’t be turned on again until the problem was fixed. A message currently on the site instructs customers to call the firm’s 800 telephone number to learn the status of their orders.

Congrats dude! Now if they had only been kind enough to put a link to your site:D

:beer: What's the story behind the fame?? How'd you get in touch with msnbc (or vice versa)

The part of the story that was removed:

"He was buying a pink teddy with matching bra and suspenders, when he stumbled across a bug" :D

Congrats.

Damn ... now you know my panties and bra sizes... oh wait.. you are not supposed to know about my fetish :D :D :D

Congrats Jay, bad silversurfer...lol

Originally posted by timechange
The part of the story that was removed:

"He was buying a pink teddy with matching bra and suspenders, when he stumbled across a bug" :D
:emlaugh: :D

:D :agree:

Before TC posted that in bold, I was thinking that we were simply reading about the possiblity of finding out Jay's fetishes.
He was buying a pink teddy with matching bra and suspenders.
Now both of those are cleared up.
Good job Jay. Now he can tell his wife he was simply doing research.

heh

A little late on the post, but I've been recovering from last night's feast. Anywho, like others have said, congratulations on the publicity. Although, next time let us know when your on a real news channel. ;) (just joking)

LOL - Thanks for the responses everyone :)

As for how I got in touch with MSNBC - I just emailed the reporter Bob Sullivan. He had written a few other technology related articles on the site, so I figured, what the hell ... I have nothing to loose. A day after I emailed him, he called me up and we chatted for a bit. The next day the article was up on the web.

I only went to the media after I got the song and dance at Victoria's Secret. One lady went so far as to tell me "Well, that's just the way the Internet works" and "We only tell that the ordering part of our site is secure" and "Your credit card information isn't up there, so what's the big deal".

Pretty cool, huh?

[Edit - I need to learn how to copy / paste correctly :D ]