4 mo. ago • 93%

BIXI got breached

I know this because I use SimpleLogin to provide each service with its own specialized email address. You can see in the picture the address starts with bixi@sl.***

It's also possible but unlikely that they sold user data.

27 comments

I wouldn’t expect a lot of overlap between MAGA / crypto idiots and bike share users (especially in Montreal), but there’s the proof. Weird.

14
I also assign unique eMail addresses for my online accounts, and also got this eMail today.

It's likely that Bixi got hacked, not that they sold the eMail address.

Just do what I do -- change the eMail address slightly on the mail server and on your online account.

9
- Oh yeah absolutely, it was just concerning to me that Bixi of all people would let my email address loose.
  
  7
haha ouais j'ai eu le même email tantot, j'utilise aussi mon nom de domaine mais j'étais pas sur si c'était un pur hasard comme j'utilise un catch-all. Merci d'avoir confirmé!

ça serait vraiment pratique d'avoir un système de signature automatique avec SimpleLogin avec protonmail comme proposé dans ce blog: https://kevincox.ca/2022/07/07/signed-email-addresses/ comme ça, seul le courriel avec la signature unique peut recevoir des messages, et des messages perdus par des bots qui tentent des noms de domaines au hasard qui pourraient avoir un catch-all se font automatiquement rejeter.

update: simplelogin fait quelquechose presque comme j'aimerais, mais c'est pas aussi bien intégré que j'aimerais

6
- Haha yeah I got the same tantot email, I also use my domain name but I wasn't sure if it was a pure chance like I use a catch-all. Thank you for confirming!
  
  It would be really convenient to have an automatic signature system with SimpleLogin with protonmail as proposed in this blog: https://kevincox.ca/2022/07/07/signed-email-addresses/ like that, only the email with the single signature can receive messages, and messages lost by bots that try random domain names that could have a catch-all are automatically rejected.
  
  Update: simplelogin does something almost as I would like, but it's not as well integrated as I would like
  
  Apple’s native translation Edit: for those browsing by All, didn’t see the community at first :)
  
  5
I think it's more likely they got breached, or a third-party was breached (I see "zoho" in there). It's easy for companies with shitty code to leak things like SendGrid tokens and web scrapers pick them up and use them for shit like the email you got.

I do the same thing for my emails, it's wild to trace back who leaked my email addresses. Man I hate how lousy our tech security is these days, or rather, the lack of fucks given and the lack of protections for consumers. Companies would rather buy cybersecurity insurance than actually make their shit secure.

4
- I just checked some older eMails, and it's not their mail provider / API token that got breached (previous messages used cyberimpact, not zoho).
  
  2
- This is probably the case, I've updated my title.
  
  1
This is not sufficient for your conclusion given the burden of proof required for this claim. And, to be clear, you are claiming that: This organization controlled by the municipality is SELLING your email address. Your proof is a screenshot with the addressed censored. Not that there was a leak, not that someone guessed this handle, not that PBSC got hacked, not that you typed the wrong handle into a form. I can run this past bixi for you if you DM me your address, but you're assuming a lot and I would bet not just MAGA but real coins that you're wrong about bixi selling your info.

3
- That's a fair point, it's totally possible they got breached, I'll update my title / desc accordingly :)
  
  Btw, as far as I know, Bixi is owned by Lyft and not the municipality, but feel free to correct me.
  
  3
  
  Bixi is owned by Bixi Montréal a non profit created by the city in 2014.
  
  Your confusion is probably that the founding company, PBSC, is now owned by Lyft. Now called PBSC Urban Solutions, it was the international operations portion of the company before the bankruptcy.
  
  3
- Btw I contacted them by email this morning and gave them all the information I have, waiting on a reply.
  
  I sent you a PM with the information, let me know if you got it :)
  
  1
  
  I’ve gotten no response from them after a couple of days
  
  1
Pour ma part je n'ai pas reçu ce joli courriel. Peut-être que leur modèle de traitement pense que je suis trop pauvre pour leur arnaque 🤷

2
- Il est possible que tu sois tombé sur une autre liste de distribution, Zoho ne semble pas être leur fournisseur courant.
  
  1
  
  Ou alors la possible fuite se serait produite avant mon inscription en 2019. C'est quand même intriguant comme situation en lien avec bixi
  
  2
I was about to send them an email... Why havent they disclosed publicly? They have my credit card info

The spam i got was for MAGA coin lol

2
There's a typo in the screenshot. It seems to use the french word "mouvement", which seems very odd to me in this far right US nationalist context.

2
- Do you think the scam came from within Quebec and autocorrect kicked in? :P
  
  2
  
  Perhaps the far right movement in France?
  
  3
@isVeryLoud I got the same email a few days ago from my bixi-specific account. This is pretty typical of a breach, doubt they sold it as such.

2
- Yup it is most likely a breach, I reported it to them on my side, it'd be great since you also have a single-use email address if you could also report it to them.
  
  You can give them a call after you email them the info to get them to get on it, that's what I did :)
  
  1

You've viewed 27 comments.