BBC Electric Proms mailing list compromised by spammers

Filed Under: Spam

Thousands of music fans have been sent spam offering them the anti-impotence drugs Viagra and Cialis, following a security breach on a BBC email mailing list.

According to The Daily Telegraph, the spam messages offering pills to improve sexual performance were sent to subscribers of the BBC Electric Proms mailing list.

Last week it was announced that music stars scheduled to perform at the music festival included Burt Bacharach, Chaka Khan, Razorlight, Goldfrapp, Barry Gibb and Keane.

BBC Electric Proms mailing list

Details of the incident, and exactly how subscribers came to be sent the email are sketchy, and the newspaper report suggests that firewalls and encryption would have better protected the details of susbcribers. However, it seems to me much more likely to be human error, or a simple misconfiguration of the mailing list software, that allowed an unauthorised message to be sent to the entire mailing list.

A BBC spokeswoman is quoted as having said, "As a result of an administrative error, spam mail received by the BBC was accidentally sent out to subscribers of the Electric Proms mailing list. We apologise for this mistake and have contacted everyone on the list to explain the situation. We wish to assure all subscribers that no details have been passed on to third party companies and all the data held on our systems is completely secure."

That sounds to me like either someone accidentally approved a message to be sent to the list that shouldn't have been, or the list was misconfigured to allow anyone to send messages to it without approval. If you run a mailing list which regularly communicates with a wide number of people, you would be wise to ensure that all messages sent to it are legitimate and approved.

If anyone knows any more, or received the apology from the BBC, please pass it on to me so I can look into this further.

Long time followers of news on the Sophos website will know that this is not the first time that a BBC mailing list has sent an unauthorised message. Five years ago, ardent fans of The Archers, the world's longest running drama serial, were accidentally sent a copy of the Sobig worm. Many listeners had subscribed to The Archers' email newsletter in order to receive daily updates on the soap opera's latest developments.

About the author

Graham Cluley is senior technology consultant at Sophos. The readers of Computer Weekly voted him security blogger of the year in 2009 and 2010, and he pipped Stephen Fry to the title of "Twitter user of the year" too. Which was nice. He was also named "Best Security Blogger" by the readers of SC Magazine in 2011. You can subscribe to Graham's updates on Facebook, follow him on Twitter and circle him on Google Plus for regular updates.