Spam to an email address I only used once?

[Devilwolf]

Over the holidays I purchased some movies (yes porn movies). I own my own domain, and used an email address like this:

companyname[at]mydomain

A few days later I start getting porn spam from that same address and ONLY that address (ie: not a dictionary attack). So far the spams have been for chinese porn sites that seem to die as soon as the spam is sent.

The company has a typical privacy policy that claims they don't spam or sell emails. They are physically located in California, but list a business address ar a PMB in Washington State, and seem to be incorporated in Panama. (that is where their USC 2257 records are kept).

I've often read stories about companies being sued for stuff like this - but have no clue how to shop this around for lawyer, any advice.

Since both the company and I are physically in the State of California, do I have any additional rights under CA's data breach laws?

Thanx

[turetzsr]

...IANAL but it seems to me you have a nearly impossible prerequisite task: to prove that the only possible reason you could be receiving the spam is that you dealt with the company from which you purchased the movies. If, for example, you provided your e-mail address over the internet, it might have been possible for your e-mail address to have been stolen before it even reached your supplier.

[Lking]

Based on the volume of spam I receive promoting pornography web sites, I would think that ones expectation of privacy and the validity of any privacy or "claims they don't spam or sell emails" would be suspect.

I have no view about how the law works on the other cost.

[Devilwolf]

...IANAL but it seems to me you have a nearly impossible prerequisite task: to prove that the only possible reason you could be receiving the spam is that you dealt with the company from which you purchased the movies. If, for example, you provided your e-mail address over the internet, it might have been possible for your e-mail address to have been stolen before it even reached your supplier.

I understand that, but most companies that do stuff like this will do it over and over. Eventually they will leave a paper trail, someone has to be the first to cry foul. Its possible the company might even be innocent, and that a contractor or employee did this.

[Devilwolf]

And then its more interesting... Now I'm getting spam on my Gevalia email address (Gevalia is a large mail order "coffee of the month" club). This spam is for some nigerian lotto.

I can see a porn company getting hard up for a cash flow and selling email addresses under the table... but its harder to imagine executives from Gevalia signing a deal with Dr. Mogobo in Laos...

[rconner]

I can see a porn company getting hard up for a cash flow and selling email addresses under the table... but its harder to imagine executives from Gevalia signing a deal with Dr. Mogobo in Laos...

Is this an address that someone could have guessed? Sometimes that's the source of the problem. See the wiki post on spam probes.

-- rick

[Devilwolf]

Is this an address that someone could have guessed? Sometimes that's the source of the problem. See the wiki post on spam probes.

Nope. I have my domain set to forward all emails that don't have configured boxes to postmaster. I don't set up boxes for limited/one time addresses, I just gather it all in as postmaster of the domain (no one but me has an email address on my domain). So any probed email on my domain looks like a valid address.

All of the spams where bcc'd to me, but I found the address used in the headers.

[Devilwolf]

Seems this story might explain it

http://www.physorg.com/news119292499.html

"Freehold-based Too Much Media, which sells accounting software for adult Web sites, told its customers last month that a security breach on its computers allowed hackers to access various adult Web sites' subscriber lists."

[kenmce]

I own my own domain, and used an email address like this:

companyname[at]mydomain

If you choose to pursue this you will want firmer proof than email to a single, guessable, address. I would suggest you go back and buy something using an address like this:

todaystimeanddatetothesecondcompanyname[at]mydomain

after that wait a month or so while you do your other preparations and buy something again, this time using an address like:

Addyusedtobuyfromsoandsositeondatecompanyname[at]mydomain

If you start getting the same mail at all three addresses you will have established a clear pattern of behavior. It will become difficult for them to claim that it was coincidence or a one time data breach. Beyond that, good luck.