We take security seriously and want to assure Blippy users that this was an isolated incident from many months ago in our beta test, and doesn't affect current users.
While it looks super-scary and certainly sucks for those few people who were affected, and is embarrassing to us, it's a lot less bad than it looks.
This could have been phrased a bit better to include an actual apology. It's pretty easy to do: "Several months ago Blippy's limited beta test leaked data about four customers, including their credit card numbers. That is totally our fault. We have apologized to those four customers personally and have taken steps to make sure it cannot happen again. The site currently does not leak data, but those four customers' numbers are still visible on Google searches. We are working with Google to correct this and expect it to be resolved in a few hours.
Here are the improvements Blippy has made to deserve our customers' trust:"
[Edited to add:
The Japanese salaryman in me would suggest that the CEO sign this post. Phrasing might include "This was ultimately a failure of our internal quality controls, because it should have been caught several times before this data was exposed publicly. I take full responsibility for the lapse and have begun..."]
A quick elaboration on the CEO thing, because I didn't want to give the impression I'm grinding anybody's nose in it: Tactically I think it is a good idea because it demonstrates that the company has no higher priority than the users' security and their trust. (And if your business is publishing folks' info, that is probably true. Heck, everybody on the Internet who takes credit cards, in any capacity, has a built-in "Are they going to scam me?" objection to address.)
Culturally, in Japan, the title for the CEO (often) literally means "Person With The Highest Responsibility." (最高責任者 -- all the other CXOs are "Person with the Highest Responsibility For [Information, etc]") Within the company, I'm sure some junior engineer is going to get a royal chewout today, but to the rest of the world, the company is an impenetrable mass. When an employee screws up, the company has screwed up, and when the company screws up, the CEO (or division chief or whomever) apologizes because his job is managing the business such that it does not screw up.
When done well, I think this is one of the most emulation-worthy bits of the Japanese corporate culture. It sends a message internally that you will always back your people come what may, and externally that you're worthy of the trust your customers, shareholders, and business partners place in you.
It's amazing how many companies still don't get it.
You made a very public mistake -- apologize, wholeheartedly and genuinely, and accept responsibility. That's it!
Making it seem like it's not a big deal makes it come off defensive, unprofessional, and like an excuse..
Now is not that time for that -- use the mitigating details in a follow-up post that highlights your progress and what you've implemented to ensure it never happens again. Don't do it now.
Too bad there isn't a couple of mandatory classes in Evolutionary Psych. 101 and Cognitive Biases 101 for the people in charge and those who advise them. Knowing about very common human flaws could help these people avoid these same mistakes that we see over and over when these types of situations happen.
Phil Kaplan is the guy most associated with Blippy (and with the biggest reputation of the 3 people at Blippy from before Blippy). I'd consider his statement more meaningful than the CEO's. The other two blippy guys are mid-2000s graduates with 1-2 smaller projects to their names.
Phil is non-CEO due to historical accident (I think he was CEO of adbrite still when blippy was launched and maybe it would have looked bad?).
Whoa, I didn't know until just now that Phil Kaplan was at both AdBrite and Blippy. I think of him as the FuckedCompany guy, so wouldn't have thought he'd be part of something so close to the kinds of things FuckedCompany used to ridicule...
pud is a very smart guy, and I actually think the blippy concept could be successful; I just don't like the implementation.
I was thinking of doing a "sharing your amazon purchases" startup (as a way to give people advice about their own purchases; e.g. if you buy a printer, a laptop, etc., have a single place you can go to with info on your purchases -- stuff like where to get toner, owners manuals, repair services, etc.). Someone mentioned blippy, and I met him in person a few times at Founder Institute.
Yeah, I still might build it (a friend of mine from FI was interested in it, but I had to go to war at short notice). It's still not the big project I want to work on though.
Comments
We take security seriously and want to assure Blippy users that this was an isolated incident from many months ago in our beta test, and doesn't affect current users.
While it looks super-scary and certainly sucks for those few people who were affected, and is embarrassing to us, it's a lot less bad than it looks.
This could have been phrased a bit better to include an actual apology. It's pretty easy to do: "Several months ago Blippy's limited beta test leaked data about four customers, including their credit card numbers. That is totally our fault. We have apologized to those four customers personally and have taken steps to make sure it cannot happen again. The site currently does not leak data, but those four customers' numbers are still visible on Google searches. We are working with Google to correct this and expect it to be resolved in a few hours.
Here are the improvements Blippy has made to deserve our customers' trust:"
[Edited to add:
The Japanese salaryman in me would suggest that the CEO sign this post. Phrasing might include "This was ultimately a failure of our internal quality controls, because it should have been caught several times before this data was exposed publicly. I take full responsibility for the lapse and have begun..."]
A quick elaboration on the CEO thing, because I didn't want to give the impression I'm grinding anybody's nose in it: Tactically I think it is a good idea because it demonstrates that the company has no higher priority than the users' security and their trust. (And if your business is publishing folks' info, that is probably true. Heck, everybody on the Internet who takes credit cards, in any capacity, has a built-in "Are they going to scam me?" objection to address.)
Culturally, in Japan, the title for the CEO (often) literally means "Person With The Highest Responsibility." (最高責任者 -- all the other CXOs are "Person with the Highest Responsibility For [Information, etc]") Within the company, I'm sure some junior engineer is going to get a royal chewout today, but to the rest of the world, the company is an impenetrable mass. When an employee screws up, the company has screwed up, and when the company screws up, the CEO (or division chief or whomever) apologizes because his job is managing the business such that it does not screw up.
When done well, I think this is one of the most emulation-worthy bits of the Japanese corporate culture. It sends a message internally that you will always back your people come what may, and externally that you're worthy of the trust your customers, shareholders, and business partners place in you.
Patrick, it's always a pleasure reading your posts. How I wish companies in the US acted like this...
I wished all companies lived up to your standards.
It's amazing how many companies still don't get it.
You made a very public mistake -- apologize, wholeheartedly and genuinely, and accept responsibility. That's it!
Making it seem like it's not a big deal makes it come off defensive, unprofessional, and like an excuse..
Now is not that time for that -- use the mitigating details in a follow-up post that highlights your progress and what you've implemented to ensure it never happens again. Don't do it now.
Too bad there isn't a couple of mandatory classes in Evolutionary Psych. 101 and Cognitive Biases 101 for the people in charge and those who advise them. Knowing about very common human flaws could help these people avoid these same mistakes that we see over and over when these types of situations happen.
And absolutely don't use distancing language (http://en.wikipedia.org/wiki/Distancing_language). A single "sorry" is worth a thousand "we apologize"-es.
Phil Kaplan is the guy most associated with Blippy (and with the biggest reputation of the 3 people at Blippy from before Blippy). I'd consider his statement more meaningful than the CEO's. The other two blippy guys are mid-2000s graduates with 1-2 smaller projects to their names.
Phil is non-CEO due to historical accident (I think he was CEO of adbrite still when blippy was launched and maybe it would have looked bad?).
Whoa, I didn't know until just now that Phil Kaplan was at both AdBrite and Blippy. I think of him as the FuckedCompany guy, so wouldn't have thought he'd be part of something so close to the kinds of things FuckedCompany used to ridicule...
pud is a very smart guy, and I actually think the blippy concept could be successful; I just don't like the implementation.
I was thinking of doing a "sharing your amazon purchases" startup (as a way to give people advice about their own purchases; e.g. if you buy a printer, a laptop, etc., have a single place you can go to with info on your purchases -- stuff like where to get toner, owners manuals, repair services, etc.). Someone mentioned blippy, and I met him in person a few times at Founder Institute.
That's a great idea, actually.
Yeah, I still might build it (a friend of mine from FI was interested in it, but I had to go to war at short notice). It's still not the big project I want to work on though.
http://blippy.com/business/+1310-6645810epoc-04-02-card-7096...
are we still seeing the cc number?