Arrow Electronics leaked my email address - Page 1
Forum section: electronics / general

author: balazer
author_rank: Newbie
timestamp: March 27, 2025, 04:38:33 pm
content: Recently I received spam from epi-tech [.] com [.] vn, an electronic component distributor based in Vietnam. The message was sent to a unique email address that I only ever used on my Arrow Electronics website account. The only way the sender could have gotten that address is from Arrow Electronics. Either Arrow is selling their email list, or the list has been stolen. I contacted Arrow about it but didn't hear back.If you received the same spam and you're also an Arrow customer, now you know the likely culprit.

author: coppercone2
author_rank: Super Contributor
timestamp: March 29, 2025, 02:06:35 pm
content: has archer been compromised by a mole?

author: nctnico
author_rank: Super Contributor
timestamp: March 29, 2025, 03:12:21 pm
content: AFAIK Arrow has several other companies so you probably ended up onder their mailing list due to previous purchases.

author: HwAoRrDk
author_rank: Super Contributor
timestamp: March 29, 2025, 04:26:31 pm
content: Have you tried contacting compliance@arrow.com? That's the address listed for their data protection representative on their privacy policy page.For things like this I find you get more productive results going directly to the relevant people than going via general customer service.

author: Stray Electron
author_rank: Super Contributor
timestamp: March 29, 2025, 06:54:54 pm
content: Quote from: balazer on March 27, 2025, 04:38:33 pmUnfortunately businesses selling the personal information of their customers is commonplace! I had a hearing test about two weeks ago and they told me that I needed to get a hearing aid. And within a week I was getting junk mail from companies that sell hearing aids! Not only is them disclosing my name and address to the sellers an ethical violation but it's also a violation of the HIPAA laws in regard to disclosing personal medical information.For years now I've been adding a bit of unique information to my name or/and address when I give companies any information so that when I get junk mail I know what company disclosed my information. Jake Smith might be Jake A Smith when I deal with Arrow, or Jake F smith when I deal with Ford, or D Jake Smith when I deal with Dodge. etc etc.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 29, 2025, 07:25:21 pm
content: Yes, it's all the more obvious when you get email not with your name, but with one of your nicknames used on some site(s).For instance, at some point, Chevrolet was sending me commercial email mentioning the nickname I used on my old YT account. Never had posted any video on it, so it was just an account. No real doubt it had been YT selling my information to third parties.(To Google's defense, that was back when YT wasn't part of Google yet.)

author: TimFox
author_rank: Super Contributor
timestamp: March 29, 2025, 07:33:25 pm
content: What are the terms and conditions of the original websites that seem to be the source of information to the third parties?

author: madires
author_rank: Super Contributor
timestamp: March 29, 2025, 07:42:51 pm
content: It doesn't have to be a company selling their customer data. Often employees (mostly sales) leaving a company take a copy of the customer database with them. So your data may be also sold by the former employee or end up at the new employer.

author: jpanhalt
author_rank: Super Contributor
timestamp: March 29, 2025, 07:46:40 pm
content: Usually, companies promise never to sell your information but they share with "business associates" and likely other pseudonyms like improving service to users. What's`the difference? You agreed to the latter and reap the benefits. You only have 2 options: accept that fate or go somewhere else.

author: Analog Kid
author_rank: Super Contributor
timestamp: March 29, 2025, 07:58:00 pm
content: Quote from: jpanhalt on March 29, 2025, 07:46:40 pmAh yes, the wonderfulness of adhesion "contracts" ...

author: balazer
author_rank: Newbie
timestamp: March 31, 2025, 01:59:38 am
content: Quote from: HwAoRrDk on March 29, 2025, 04:26:31 pmcompliance @ arrow [.] com is the address I emailed. I never heard back.Quote from: TimFox on March 29, 2025, 07:33:25 pmArrow's privacy policy says it may share your Personal Information with third parties for direct marketing purposes. I don't know if that means marketing for Arrow itself, or for unaffiliated third parties to do their own marketing. The policy says you can opt out. If I had seen an opt out, I certainly would have opted out, but I don't remember if I did. I may not have seen it, depending on where it is buried in the website. My Arrow account has apparently been deleted, so I can't log in to check. My last order was more than two years ago. I think it's unlikely that Arrow would have purposefully shared my personal information with a competitor for marketing purposes.Quote from: nctnico on March 29, 2025, 03:12:21 pmThe email address that I received spam at was the one I registered at the arrow [.] com website.For many years now I've been giving away unique email addresses whenever I register at a website or with a company. So I've gotten quite a feeling for how these leaks work. >90% of websites never leak my addresses. But quite a lot have. It's big companies and small websites, including all of the high profile leaks that you've heard about, plus many that you haven't. In most cases, the resulting spam has nothing to do with the site that leaked my address. This Arrow leak is much more specific, being to an unaffiliated competitor. If I had to guess, someone on the inside got access to Arrow's email list and dumped it, taking it with them to their new employer. That suggests poor access controls on Arrow's side, allowing employees or agents access to much more information than they should have.

author: JoeyG
author_rank: Regular Contributor
timestamp: March 31, 2025, 02:28:59 am
content: If using Gmail , you can track who sold your email address

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 31, 2025, 12:33:18 pm
content: Quote from: jpanhalt on March 29, 2025, 07:46:40 pmYes, that's common practice, now usually required to be mentioned in the "privacy policy" of websites, but in older days that wasn't always clearly mentioned.That's pretty much what the EU calls "legitimate interest". Legitimate my *ss.