When traders buy or sell on auction sites, they have to assume the site will protect their data. Any security compromise that can cost users money will be remembered for a long time.
So it was interesting to see the complaint last week by Taobao, the new consumer arm of business-to-business auction site Alibaba.
According to a cease-and-desist letter sent to Yahoo!, 1Pai.com.cn, the auction site launched this month by Yahoo! and Sina, managed to steal business data including the contact details of 50,000 of Taobao's traders. Sounds like they got off lightly, as Taobao claims to have 600,000 users.
Even more surprising was the way the heist was allegedly carried out. Taobao said that over a period of four days, access to its site was unusually slow and by the time its tech staff had traced the source of the problem, someone had managed to download 121 gigabytes of data to a fixed IP address belonging to Yahoo!
It is hard to know what to marvel at the most - the apparent discrepancy between the number of contact details stolen and the number of customers Taobao claimed to have, that it took engineers four days to find why the site was inaccessible, that so much data could be downloaded to a single-fixed IP address without anyone noticing, or that the data should be available to any passing hacker.
Alibaba recently received US$82 million from investors to help expand its China business. Too bad it didn't spend some of that on hiring a network administrator.