Story image

Online retailer Mighty Ape fixes wishlist privacy flaw

07 Feb 2019

New Zealand online retailer Mighty Ape has been quick to 'fix' issues that publicly shared some customers’ birthdates and product wishlists.

Mighty Ape has more than 250,000 customers and sells a range of technology, clothing, games, books and puzzles, music and other items.

One of its account settings allows customers to add products to their ‘wishlists’ for future review or purchase. Users can choose to keep these wishlists private or public – although it seems many were unaware those options existed.

Last week users on various forums including Reddit and GamePlanet alerted others to the fact that Mighty Ape wishlist privacy settings were, in some cases, public and available for anyone to see.

Public information included names, emails, birthdates and all products available on a user’s wishlist. 

While the issue only affected those whose wishlists were public (either by choice or by default), Mighty Ape quickly moved to rectify the issue.

Yesterday (February 6), Mighty Ape sent an email titled We're improving our Wish List privacy settings to users stating that the company had fixed the issue. The email says:

“Protecting the interests of our customers is extremely important to us. From today onwards, all new Wish Lists will be created as private by default. Customers will still be free to share links to their Wish List with loved ones, but their list will not show up in our 'Find a Friend's Wish List' search.

“We have also removed the year from the birth date field in our search results. Additionally, you must now opt-in to showing your birth date from the 'Edit List' menu on each of your Wish Lists. The purpose of the birth date is to make it easier for people to identify a Wish List as yours, but we understand this information can be sensitive.

“To give everyone the opportunity to decide if they would like their Wish List to be searchable; all existing Wish Lists have been set to private.

“If you would like your Wish List to remain private, you don't need to do a thing. If you would like your friends and family to be able to search for your Wish List, you will need to navigate to your Wish List, scroll to the bottom of the page and click 'Make my Wish List public'. Your Wish List will then be viewable from the 'Find a Friend's Wish List' page if someone searches for your full name or your email address. Each Wish List has its own independent privacy settings so you will need to update each list individually.”

Venafi and nCipher Security partner on machine identity protection
Cryptographic keys serve as machine identities and are the foundation of enterprise information technology systems.
Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.
How blockchain could help stop video piracy in its tracks
An Australian video tech firm has successfully tested a blockchain trial that could end up being a welcome relief for video creators and the fight against video piracy.
IBM X-Force Red & Qualys introduce automated patching
IBM X-Force Red and Qualys are declaring a war on unpatched systems, and they believe automation is the answer.
Micro Focus acquires Interset to improve predictive analytics
Interset utilises user and entity behavioural analytics (UEBA) and machine learning to give security professionals what they need to execute threat detection analysis.
Raising the stakes: McAfee’s predictions for cybersecurity
Security teams and solutions will have to contend with synergistic threats, increasingly backed by artificial intelligence to avoid detection.