Certain ProZ.com user information -- including private data -- was accessed improperly by a site intruder in June of 2009. The following forms of data were accessed:
- Name
- Email address
- Postal address
- Phone number
- Login information (note that passwords are protected by encryption)
The security breach became apparent after some ProZ.com users reported receiving unsolicited email from a website called outsourcingroom.com (or oroom.com). Others reported finding that their personal information had been used to create profiles at that site without their permission, and an investigation was launched.
The security hole that was exploited was filled, and a number of steps were taken to make it more difficult for exploits of this nature to be performed in the future.
Frequently asked questions about this incident
How could this happen?
Hackers exploited a weakness in ProZ.com's security systems. The problem has since been fixed.
Were credit card details or other financial information obtained?
No. In fact, ProZ.com does not store such data.
Which profiles were accessed?
Profiles at least three years old.
Were all profiles that are at least three years old accessed?
There was an automated routine that attempted to access the data in profiles one by one in sequential order. If your profile was created before May of 2006, unfortunately it is reasonable to assume that your data was accessed.
I registered after May of 2006. Does that mean that my profile was not accessed?
Yes, it is reasonable to assume that your data was not accessed. Note, however, that if you are are registered with Elance or other similar services that were accessed by the perpetrators, your data may have been accessed through another source.
How would I know if a profile has been created at outsourcingroom.com using my data?
There is a search function on the site. (Try searching for both your last name and your ProZ.com username.) You may also enter a support request to ask about your specific profile.
My name is there. What might happen as a result?
If your name is there, it is likely that your email address has been obtained, and it is therefore possible that you will receive unsolicited email. If you have a telephone number in your profile, it is possible (but not likely) that you would be called.
Has anyone received unsolicited email?
Yes. A number of users have reported receiving unsolicited email inviting them to register at "oroom.com", which was described in terms similar to those used to describe ProZ.com, Elance and similar services.
How can I prevent that?
If you maintain a spam filter, you may want to filter out email from "oroom" and "outsourcingroom".
Has anyone been called, or otherwise been affected in relation to this incident, other than by spam?
Not to our knowledge; there have been no such reports.
I am concerned about identity theft as a result of this incident. Should I be worried?
No. The data accessed in this incident does not include the types of data normally associated with identity theft, ie. credit card, bank info, national identity numbers, etc.
Spam is the worst that anyone has reported as a direct result of this incident.
My name is not there, even though I created it before May of 2006. Does that mean I am in the clear?
Not necessarily. It may be that your information has been posted, but is simply not coming up in a search. It may also be that your information was obtained, but for some reason was not placed on the site.
Encrypted passwords were accessed. Does this mean someone can log into ProZ.com as me?
Since the passwords were encrypted, and therefore not human-readable, it is unlikely. Still, it is good practice to use passwords that are difficult to guess, and to change your password periodically. (For additional reassurance, it is now also possible to view data on any open logins you have.)
Can you explain in more detail how password encryption works?
If your password is "uncle3pablo", what is stored in the database is something completely different: an encrypted version of the password like "dW5jbGUzcGFibG8=". What was accessed in this incident were the encrypted versions. If a person attempts to log in to your account with the encrypted version of your password, it will fail.
Then why should we change our passwords?
It is generally good practice to select complex passwords and change them periodically, and in this case it is an added security precaution.
How do I change my password?
Go to: http://www.proz.com/?sp=new_password
Is this incident related to similar news from Elance.com?
Yes. Several sites were hit similarly around the same time. (Some ProZ.com users with profiles less than three years old have reported finding profiles created for them at outsourcingroom.com, and upon investigation concluded that their information had been obtained via Elance.)
What are ProZ.com staff members doing about this?
From the time it became clear that user data had been accessed improperly, ProZ.com's staff made it their top priority to address this incident. The following steps were taken:
- Attempts have been made to halt the unauthorized use of your information by those operating outsourcingroom.com, or failing that, to get the site de-indexed. Efforts by other sites appear to have resulted in the temporary removal of the site from the internet, however, it has been moved and reappeared.
- A security review has been performed and various measures have been taken to increase site security.
- An outside firm will be hired to monitor and certify ProZ.com security practices.
- Password requirements have been strengthened.
Could you be more specific? What attempts have been made to get the information removed from the Internet?
ProZ.com staff members consider it the responsibility of the site to do everything within reason to have the private content that was improperly accessed removed from the web. To this end, as a first step a request for removal was sent to those operating outsourcingroom.com. There was no response and attempts to establish contact were not successful. A "cease and desist" letter and DMCA filings were then prepared. Legal options have been investigated but no action has yet been initiated. A report has been given to appropriate law enforcement bodies, ISPs hosting the site have been notified, and other steps have been taken. Unfortunately, there is no guarantee that any of these efforts will be successful in the near term, if at all. However, the process will be pursued to the extent possible.
What laws govern ProZ.com's handling of personal data? How does ProZ.com go beyond that?
It is a goal of ProZ.com to meet and exceed the minimum requirements in all jurisdictions in which the site operates. Following the incident, ProZ.com began working towards certification according to the U.S.-E.U. Safe Harbor Framework guidelines for handling private data, earning the certification in early 2010. Beyond that, privacy will continue to be an emphasis among the site team. Training in data privacy has always been a part of ProZ.com employee training; this training will be repeated and expanded upon. In addition, further controls will be given to members to reduce privacy related risks. For example, users will be provided with options to remove in batches data that no longer has any value. (Old quotes, etc.)
Why did it take approximately a month for notification about this to go out?
The breach was not noticed until reports of spam began to be received. At that time, information was shared in a forum thread as it was obtained, and the breach was announced in that thread hours after it had been confirmed (and within a few days of the start of the investigation).
As for follow-on steps, including sending a general notification, it was advisable for reasons of security (and in the interest of protecting user data that had not been accessed) to take certain technical precautions before calling additional attention to the matter.
There is no question that those affected deserved to be informed much sooner, and we regret that it has taken two weeks for the necessary steps to have been taken, even as staff worked overtime and through the weekends to carry out the tasks. (We admire the ability of Elance to take measures similar to those taken by us in much less time.) We have resolved to become much better equipped to respond rapidly to challenges like this in the future.
Some people have reported success in asking directly that their data be removed from outsourcingroom.com. Should I do that?
We can not advise for or against accessing outsourcingroom.com or interacting with those operating it. Exercise caution when entering any information into the site. (One member described the method she used to remove a profile from the site in a forum post.)
Will I be giving away my email address in requesting removal from that site?
If your name is listed on the site, the odds are that your email address has already been obtained. (In other words, you would not be giving new data, but rather confirming data that they already have.)
"Security breach." Do you mean that I breached the security? Or was it someone else?
It was not you, it was someone else. There has been no evidence to suggest that access was gained to user accounts, in other words, we do not believe that anyone logged in as anyone else. Rather, direct access was gained to the aforementioned data in the profiles.
"Financial information" - what do you mean exactly? There was no financial information on my profile.
Exactly.
I have a question not addressed here. Who should I talk to?
Please ask via ProZ.com's online support system. The support team is standing by to answer questions related to this incident. As questions come in, they are added with their answers on this page.
Why should questions related to this incident go through support instead of the forums?
The thread that existed on this topic contained some incorrect speculation that led to undue alarm and inconvenience for some members. The decision was made to post the facts of this incident in one "official" page, and to field any unanswered questions via the support channel, updating the page as necessary to ensure that all questions are answered efficiently and thoroughly. Your cooperation in this respect will be appreciated.