FedEx security issue

[kemasa]

FYI:

Background: I use a unique email address for each company I deal with. This allows me to know if an email is really from that company since if it is not to the proper email address then it is not a valid email message from that company. If I receive spam then the to address tracks where the email came from.

Today I received an email claiming to be from American Express, but it wasn't. It was a phishing email. The email address it was sent to was ONLY given to FedEx. This means that my email address that FedEx was given was compromised and it also is likely that others were also compromised, but unless unique email addresses are used others have no way of knowing where it came from.

I contacted FedEx but they are too stupid to read and understand anything. They replied with the stock answer that spammers forge email to make it look like it came from them, which had nothing to do with what I sent them or what happened. The IT Security people hear "email" and they instantly respond that it is not their problem.

FedEx needs to explain how an email address only given to them got to scammers in order to send me the fraudulent email message.

[ten888]

FedEx was a victim of a massive cyberattack in June. Although no data breach was reported.

If they are unwilling to investigate an incident there is way residents can file a complaint via https://oag.ca.gov/privacy/databreach/reporting

[kemasa]

Thanks.

It is easy to give unique email addresses if the company follows the email standards. There is the "+" comment option which allows a comment in the username, ie. USER+COMMENT@domain. If you put the company name in the comment field, along with a tag, it is quick and easy to do.

[readysetgo]

Isn't it also possible that you're unique email address has been hacked on your side?

Don't know how probable that is but something to think about.

[kemasa]

I don't use windoze, so no, plus then I would see it with ALL of the different addresses, which is a lot. The only email with that specific address on my machine would be from them.

[ten888]

Isn't it also possible that you're unique email address has been hacked on your side?

Don't know how probable that is but something to think about.

[kemasa]

It is only the email address given to FedEx which is being used. If other email addresses, to which there are many, were being used, it would point to elsewhere, but when it is just one, as well as other factors such as I happen to use AmEx with FedEx, it points directly at FedEx.

[rbetts]

Change your address with FedEx and send the other one to spam? Sleep happy again??

[kemasa]

Change your address with FedEx and send the other one to spam? Sleep happy again??

Yes, I can do that, but that does not change the issue that the data was compromised and there is also the question what the extent of the data compromised was. Ignoring what occurred is generally not a good idea.

[rbetts]

What to do, What to do,

[kemasa]

Let others know about this issue, as well as other things, which is the point to this thread, but it does not seem that you get that, although I suspect it is because of your issues.

[Montu]

They could just be spamming randonmly generated emails to common domains.

[kemasa]

They could just be spamming randonmly generated emails to common domains.

The odds of figuring out the email address is quite low and then there would be the same spam message to other email addresses, so that is not very likely.

[Anonreg_89323423]

Probably not related, but I only had one package completely disappear and it was Fedex from a couple weeks ago. It was ammo, like $15. They paid out the insurance claim to Brownells and I was refunded but still, watch out.

[kemasa]

There are a lot of porch package thieves. It is best to not have a package delivered unless someone is home, use an office address instead (if it is acceptable).