Is Bitdefender sharing our info?

I can tell you categorically that Bitdefender HAS 100% definitively shared our details with unknown parties.

Here's why:

I use Apple's iCloud+ which has Hide My Email, and I generate a new unique email alias for EVERY single new website, service, app, whatever I sign up to. If I ever receive spam, all I need to look at is what email address the spammer sent it to, and I know exactly which company leaked my data.

In this case, I received an IDENTICAL email to the screenshot that OP posted, and the email they sent it to is the SAME email I generated and used only for Bitdefender. Haven't even entered that email anywhere for 2 years, which is when I signed up to Bitdefender.

To be crystal clear. I technically have hundreds of unique email addresses that I only ever use for each specific website/service. There is no way anyone could have acquired my Bitdefender email alias, other than Bitdefender leaking/sharing it.

I have just contacted Bitdefender's live chat and sent them the scammer's email, and they said "It's from the unofficial Bitdefender reseller. What I recommend is not to buy from them. We are still investigating this reseller." Happy to post email transcript or screenshots.

How utterly ridiculous is it that Bitdefender, a service that is supposed to be PROTECTING us, is actually leaking our data to others? Including other companies under investigation? And Bitdefender expects me to renew when the time is up in a couple months? Hell no. Bitdefender is now permanently blocklisted – never again.

No excuses when you cannot even stick by your own product's purpose.

@Alexandru_BD Thanks for confirming those details. Regarding how the fraudster(s) obtained our email addresses in the first place, as I mentioned this absolutely MUST have originated from Bitdefender. It is impossible for anyone else to have obtained the single purpose email address I generated, copied and pasted once 2 years ago to sign up for Bitdefender.

I have hundreds of email address aliases through iCloud+. The email address that the fraudster(s) used was the exact same one I created and used once solely for Bitdefender. I have never received any other Bitdefender scam emails in my life. Therefore it is crystal clear that Bitdefender has shared/leaked customer data, and I would like this to be investigated internally immediately please so that the full scope of this unauthorized sharing/leaking can be advised to customers who trusted Bitdefender with their data. We would then be able to understand what other potential sensitive data of ours Bitdefender has shared/leaked to fraudsters and if necessary, take precautions e.g. identity theft measures.

Has Bitdefender shared/leaked our names too? Our card details? Billing info? etc. We need to know this. Thanks.

I received an email from sales@solutions-antivirus.store I forwarded it to Bitdefender Data Protection Office. What concerns me is after checking the message source of the email, my full name, which appears on my credit card, was connected to my account email address. I don't use my real name in my Bitdefender online account. How they managed to retrieve this information is disquieting. I haven't heard back from Bitdefender DPO.

I ask where it states that BD customers consent to their data being shared to fraudsters and the other 'legitimate purposes' that go against the entire purpose of BD – you send a bunch of links and can't point to any part that answers my questions. Your replies are pointless.

Hi Mike, thank you for forwarding this on.

ICO states "You must report a notifiable breach to the ICO without undue delay, but not later than 72 hours after becoming aware of it." Please can you confirm whether Bitdefender have contacted ICO yet? As this is now almost 2 weeks since multiple customers reported this to Bitdefender, with no report or proper response released to the customers whose data has been shared/leaked, I will be personally filing a report with ICO if we do not receive anything from Bitdefender by the end of today.

Thanks.

Hello @orangesevenhills,

At this time I think it's far from factually evident that any form of data has been collected without consent or compromised, since there is no tangible proof in this regard and the claim is subject to an investigation that has not been concluded yet.

What you are implying is an assumption based on deduction and available facts known to you. And rightfully so, if you haven't used a specific email address elsewhere and you are absolutely certain that the address was protected accordingly and could not have been leaked someplace else, you are of course entitled to ask questions.

But here's the thing. I don't have access to your email address associated with Central, I am unaware of its level of security, when it was created and if there was a chance for it to be leaked somewhere at all, so I cannot make any statements concerning this.

My advice would be to wait for the Support teams to provide a response for your inquiry, as I'm not in the position to advise you on the next steps and cannot know for sure by what means you have received that phishing message.

If you have provided your registered email address to the Support representatives, the infosec teams will track down all possible leads to see where the rabbit hole goes.

Regards,

Alex

Thanks for replying Alex. I disagree however, as the evidence is clear. It is simply impossible for anyone else on this planet to have known this email address exists, besides Apple and I. And sorry but wait for the support teams? You mean the one I replied to on 8th Aug requesting answers and accountability yet still haven't bothered to reply?

Also, today, I received a further 2 emails to the same iCloud+ alias I generated and used once for Bitdefender. Both were from notification@emails.avast.com, which appears to be Avast's genuine email, and the links in the email all direct to Avast's official website.

The subject of the first was 'Great news! No password leaks for your email.', while the other was 'Want the latest from Avast?'. The first one mentions a "password leak report from Avast Hack Check", saying "Good news! No new leaks were found for the email address [the iCloud+ alias I used for Bitdefender]".

Don't tell me Bitdefender staff are using another company's service to see whether my email address has been compromised... This is ridiculous. I create an iCloud+ alias for Bitdefender 2 years ago, create a Bitdefender account with it, log in and that's it. 2 years later, I get spam emails selling me a Bitdefender subscription from scammers, then once I report it to Bitdefender and repeatedly try to get answers and hold you accountable for your actions, suddenly I get these 2 emails from Avast. I don't remember giving you my consent to share my data with Avast? (And no, I have NEVER used this iCloud+ alias with Avast or ANY other company whatsoever.)

Bitdefender, STOP SHARING/LEAKING MY DATA!!!!!!! I am now reporting this to ICO for investigation and speaking with Avast to acquire the IP address that was used to submit my Bitdefender email into Avast's 'hack check' service. What is wrong with your company. You need to inform your customers what the hell you are doing with your customers' data, IMMEDIATELY.