This article is more than 1 year old

Sears sued for website that leaked customer purchases

Hackers get what they want

Sears Roebuck and Co. is taking more flack from privacy advocates who say the retailer's websites don't adequately protect customer privacy.

On Friday, a Sears customer filed a suit in Illinois state court alleging the retailer's Managemyhome.com website is "fatally flawed and was designed in such a way as to significantly compromise the private information of its customers." The complaint, which requests class-action status, seeks a court order requiring customer data be secured on the site and an award for damages.

The complaint was filed on behalf of Christine Desantis, a customer whose details about 10 purchases made over eight years was made available to anyone savvy enough to exploit the bug. She doesn't know if anyone actually accessed the information.

"At the most simple level, anyone can now access Sears’s customers private purchase history, meaning that a nosy person can find out how much his neighbor spent on a new washing machine or lawnmower," the complaint alleges. "More problematically, marketing companies can mine the Managemyhome website for data about Sears customers, in order to transmit detailed advertisements for additional products and/or warranties."

It goes on to say hackers could troll for information that could be used for identity theft and other "insidious" purposes.

The complaint was filed by the same law firm that successfully pursued Sony BMG over millions of compact disks that surreptitiously installed a rootkit on PCs. It was filed the same day that Harvard University researcher Ben Edelman documented how the Sears site violated its own privacy policy by exposing customer purchases. Sears says it has since disabled the ability to view a customer's purchase history on the site until it can implement a validation process that will restrict access by unauthorized third parties.

Edelman showed how it was possible for anyone with a user account on the Managemyhome site to view the purchases of other Sears customers by entering their name, street address and phone number.

The revelation came three days after Edelman documented how a separate Sears web property was installing software from ComScore that monitored all web activity on a user's computer. Sears only warned users of the privacy implications of the software on the tenth screen of a 54-screen license agreement, prompting criticism that the notice was inadequate.

"We've gotten a lot of positive response to the filing of our suit and a lot of people wanting to make sure that Sears fixes the problem sooner rather than later," said Jay Edelson, an attorney who filed Friday's lawsuit against Sears. He said his firm is considering filing a separate complaint over the installation of ComScore software.

Representatives from Sears declined to comment on the suit or the criticism of its privacy policies beyond a statement that said it had added the purchase history functionality to give customers easy access to useful information.

"We take our customers' privacy concerns very seriously," the statement read. "We appreciate the efforts of those who brought the issue to our attention." ®

More about

TIP US OFF

Send us news


Other stories you might like