Blippy Leaks Four Credit Card Numbers

One day after The New York Times explored the rise in social Web sites that expose information about users' purchases and activities, declaring that people are becoming more relaxed about privacy, a minor data breach at one such site offers a reminder that people do indeed have something to hide.

Blippy.com, a social Web site that allows users to share information about things they've bought, was found to have leaked four credit card numbers. All of the numbers begin with 5424, the Citibank Mastercard prefix, suggesting that statements provided to Blippy by one particular payment processor contained too much information.

A Google search for the exact phrase "from card" in conjunction with the site: operator to restrict the search to the blippy.com domain turned up the four credit card numbers for purchases made at merchants such as Audible, Exxon Mobile, Pizza Hut, iHop, Kroger's, Starbucks, Wendy's, and numerous others.

The same search on Bing.com does not reveal credit card numbers and it appears that Bing has not even indexed them -- a search for a specific credit card number returns no results in Bing.

Ask.com and Yahoo.com searches also do not return credit cards from Blippy.

The reason for this is that Google's indexing procedure is not only extremely fast but also aware of new data on servers -- even data that has not been linked to other pages -- if the site owner has published what's called a site map. Site maps tell Google's crawler where to look for information.

In a phone interview, Blippy co-founder and CEO Ashvin Kumar said that Blippy has asked Google to remove the information.

Google responded as this article was being written. Subsequent efforts to access the search results pages were rejected with the following message: "We're sorry ... but your computer or network may be sending automated queries. To protect our users, we can't process your request right now."

In a blog post, the company offered an official statement: "Many months ago when we were first building Blippy, some raw (not cleaned up, but typically harmless) data could be viewed in the HTML source of a Blippy Web page. The average user would see nothing, but a determined person could see 'raw' line items. Still, this was mostly harmless -- stuff like store numbers and such. And it was all removed and fixed quickly."

But according to the company, Google indexed this information before it was cleaned up. While cached pages were subsequently updated to reflect the clean versions of the Web pages published by Blippy, its search snippets continued to include the data that had long since been removed from Blippy's files.

In a statement, Google confirmed that it was dealing with the issue.

"Around 9:00 a.m. Pacific we learned that Blippy.com had published credit card numbers on their website," a Google spokesperson said in an e-mailed statement. "As part of our usual crawling and indexing process, these numbers became discoverable in Google search snippets. Blippy contacted us and we took special measures to remove the numbers from search results. We fixed the problem around 11:20 a.m. Pacific and the numbers should no longer be discoverable in search."

Aware that news of the incident was spreading on Twitter, Google accelerated its takedown procedure for the information. But even so, the exposed credit card numbers have been copied to online forums like anonboard.com.

This means that the unfortunate individuals affected face an elevated risk of fraud or identity theft, even with the removal of their information from Google's search snippets.

Asked whether this incident might make some people reconsider sharing information, Kumar said, "Naturally people may feel that way, but they should know that security is a super-important issue for us. At the end of the day, we're all users of Blippy too and we don't want our information exposed."