washington
Auto Added by WPeMatico
Auto Added by WPeMatico
With two giants calling the shots and collecting whatever tolls they see fit, mobile software makers have long complained that app stores take an unfair cut of the cash that should be flowing directly to developers. Hearing those concerns, a group of senators introduced a new bill this week that, if passed, would greatly diminish Apple and Google’s ability to control app purchases in their operating systems and completely shake up the way that mobile software gets distributed.
The new bill, called the Open App Markets Act, would enshrine quite a few rights that could benefit app developers tired of handing 30% of their earnings to Apple and Google. The bill, embedded in full below, would require companies that control operating systems to allow third-party apps and app stores.
It would also prevent those companies from blocking developers from telling users about lower prices for their software that they might find outside of official app stores. Apple and Google would also be barred from leveraging “non-public” information collecting through their platforms to create competing apps.
“This legislation will tear down coercive anticompetitive walls in the app economy, giving consumers more choices and smaller startup tech companies a fighting chance,” said Senator Richard Blumenthal (D-CT), who introduced the bipartisan bill with Sen. Marsha Blackburn (R-TN), and Sen. Amy Klobuchar (D-MN). Klobuchar chairs the Senate’s antitrust subcommittee and Blackburn and Blumenthal are both subcommittee members.
Senator Blackburn called Apple and Google’s app store practices a “direct affront to a free and fair marketplace” and Sen. Klobuchar noted that their behavior raises “serious competition concerns.”
The bill draws on information collected earlier this year from that subcommittee’s hearing on app stores and competition. In the hearing, lawmakers heard from Apple and Google as well as Spotify, Tile and Match Group, three companies that argued their businesses have been negatively impacted by anti-competitive app store policies.
“… We urge Congress to swiftly pass the Open App Markets Act,” Spotify Chief Legal Officer Horacio Gutierrez said of the new bill. “Absent action, we can expect Apple and others to continue changing the rules in favor of their own services, and causing further harm to consumers, developers and the digital economy.”
The Coalition for App Fairness, a developer advocacy group, praised the bill for its potential to spur innovation in digital markets. “The bipartisan Open App Markets Act is a step towards holding big tech companies accountable for practices that stifle competition for developers in the U.S. and around the world,” CAF executive director Meghan DiMuzio said.
Hoping to head off future regulatory headaches, Apple dropped its own fees for companies that generate less than $1 million in App Store revenue from 30% to 15% last year. Google followed suit with its own gesture, dropping fees to 15% for the first $1 million in revenue a developer earns through the Play Store in a year. Some developers critical of the companies’ practices saw those changes as little more than a publicity stunt.
Developers have long complained about the high tolls they pay to distribute their software through the world’s two major mobile operating systems. That fight escalated over the last year when Epic Games circumvented Apple’s payments rules by allowing Fortnite players to pay Epic directly, setting off a legal fight that has huge implications for the mobile software world. Following a May trial, the verdict is expected later this year.
“This will make it easier for developers of all sizes to challenge these harmful practices and seek relief from retaliation, be it during litigation or simply because they dared speak up,” Epic Games VP of Public Policy Corie Wright said of the new bill.
Unlike Apple, Google does allow apps to be “sideloaded,” installed onto devices outside of the Google Play Store. But documents unsealed in Epic’s parallel case against Google revealed that the Play Store’s creator knows the sideloading process is a terrible experience for users — something the company brings up when pressuring developers to stick with its official app marketplace.
The counterargument here is that official app stores make apps safer and smoother for consumers. While Apple and Google extract heavy fees for selling mobile software through the App Store and the Google Play Store, the companies both argue that streamlining apps through those official channels protects people from malware and allows for prompt software updates to patch security concerns that could jeopardize user privacy.
“At Apple, our focus is on maintaining an App Store where people can have confidence that every app must meet our rigorous guidelines and their privacy and security is protected,” an Apple spokesperson told TechCrunch.
Adam Kovacevich, a former Google policy executive who leads the new tech-backed industry group Chamber of Progress, called the new bill “a finger in the eye” for Android and iPhone owners.
“I don’t see any consumers marching in Washington demanding that Congress make their smartphones dumber,” Kovacevich said. “And Congress has better things to do than intervene in a multi-million-dollar dispute between businesses.”
At least in Google’s case, the counterargument has its own counterargument. Android has long been notorious for malware, but apparently most of that malicious software isn’t making its way onto devices through sideloading — it’s walking through the Google Play Store’s front door.
Powered by WPeMatico
The need for more affordable housing has never been more urgent as a shortage in the U.S. housing market persists.
Startups attempting to help address the shortage in a variety of ways abound. One such startup, Abodu, has raised $20 million in a Series A funding round led by Norwest Venture Partners. Previous backer Initialized Capital also participated in the financing, along with Redfin CEO Glenn Kelman, former Stockton, California Mayor Michael Tubbs, GGV investor Hans Tung and Paradox Capital’s Kyle Tibbitts.
The California legislature changed laws in 2017 to make it easier to build Accessory Dwelling Units (ADUs). Then on January 1, 2020, the state of California made it dramatically easier to add extra housing units to single-family home sites. Cities and local agencies have to quickly approve or deny ADU projects within 60 days of receiving a permit application. The state also now prevents cities from imposing minimum lot size requirements, maximum ADU dimensions or off-street parking requirements.
Redwood City, California-based Abodu, which builds prefabricated ADUs, was founded in 2018 to serve as a “one-stop shop” for building an ADU, or as some describe it, a home in a backyard.
Image Credits: Co-founders John Geary and Eric McInerney / Abodu
What sets the company apart from others in the space, its execs claim, is that it not only builds and installs the units, it helps homeowners with the painful process of getting permits. Abodu says it pre-approves its structural engineering with California state-level agencies to ensure its units can be built statewide and works with local agencies to pre-approve its foundation systems to ensure projects can proceed on predictable timelines.
It also claims to offer a cheaper and faster process than if one were to build an ADU from start to finish. Specifically, the startup claims that one of its backyard homes can be installed in just 10% of the time it would take for a traditional ADU to be built.
Abodu has been active in the market, selling and building its ADUs since the fall of 2019. Since then, it has put “dozens and dozens” of units in the ground, and has multiple dozen units in production on top of that, according to CEO and co-founder John Geary. So far, it’s operating in the Bay Area, Los Angeles and Seattle. The company claims it can deliver an ADU in as little as 30 days in San Jose and Los Angeles thanks to the cities’ pre-approval process. In other cities in California and Washington, turnaround is “as little as 12 weeks.” But a standard bespoke project takes 4-5 months from start to finish, according to Geary.
The startup’s three products include a 340-square foot studio; a 500-square foot one bedroom, one bath, and a 610-square foot two bedroom unit. All have kitchens and living space.
Pricing starts at $190,000, but the average project cost across all sizes is around $230,000, Geary said, inclusive of permits and site work.
There are a variety of use cases for ADUs, the most popular of which is to house family and for rental income.
“During the pandemic, multigenerational living has been at an all-time high. There are acute family needs that people are trying to solve for,” Geary said. “In addition, folks are earning extra money by renting them out to members of the community such as teachers or fireman, a single person or younger couple.”
Next, Abodu is eyeing the San Diego market.
Earlier this week, we covered the recent raise of Mighty Buildings, another Bay Area-based startup building ADUs and other housing. The biggest difference between the two companies, according to Geary, is that Mighty Buildings is focused on innovation in construction with its 3D-printed method.
“We decided early on that we didn’t want to reinvent the wheel from the construction standpoint,” Geary said. “Instead, we looked at ‘how can we solve for speed and ease?’ ”
Abodu operates with an asset-light model, and doesn’t own any factories. Instead, it has built a network of factory “partners” across the Western U.S. that builds its units depending on how their capacities look at any given time.
Naturally, the company’s investors are bullish on the company’s business model.
Jeff Crowe, managing partner of Norwest Venture Partners, believes that Abodu’s “beautifully crafted units” are just one of the company’s selling points.
“John, Eric, and their team manage the end-to-end process of permitting, building, and installing on behalf of their customers,” he told TechCrunch. “And with the expedited permitting that Abodu has been granted in over two dozen cities, it has faster time-to-installation than other ADU market participants. The result has been very high levels of customer satisfaction and rapid growth.”
Former Stockton Mayor Tubbs said Abodu is tackling two of California’s most consequential issues: the statewide housing shortage and its impacts on racial and economic segregation in our neighborhoods.
“By making it fast and accessible for normal homeowners to build high-quality backyard housing units, Abodu’s success will mean integrating options for both renters and homeowners in the same neighborhoods, while supporting small landlords and property owners in building equity in their homes,” he wrote via email.
Powered by WPeMatico
The coming wave of electric vehicles will require more than thousands of charging stations. In addition to being installed, they also need to work — and today, that isn’t happening.
If a station doesn’t send out an error or a driver doesn’t report it, network providers might never know there’s even a problem. Kameale C. Terry, who co-founded ChargerHelp!, an on-demand repair app for electric vehicle charging stations, has seen these issues firsthand.
One customer assumed that poor usage rates at a particular station was due to a lack of EVs in the area, Terry recalled in a recent interview. That wasn’t the problem.
“There was an abandoned vehicle parked there and the station was surrounded by mud,” said Terry who is CEO and co-founded the company with Evette Ellis.
Demand for ChargerHelp’s service has attracted customers and investors. The company said it has raised $2.75 million from investors Trucks VC, Kapor Capital, JFF, Energy Impact Partners and The Fund. This round values the startup, which was founded in January 2020, at $11 million post-money.
The funds will be used to build out its platform, hire beyond its 27-person workforce and expand its service area. ChargerHelp works directly with the charging manufacturers and network providers.
“Today when a station goes down there’s really no troubleshooting guidance,” said Terry, noting that it takes getting someone out into the field to run diagnostics on the station to understand the specific problem. After an onsite visit, a technician then typically shares data with the customer, and then steps are taken to order the correct and specific part — a practice that often doesn’t happen today.
While ChargerHelp is couched as an on-demand repair app, it is also acts as a preventative maintenance service for its customers.
The idea for ChargerHelp came from Terry’s experience working at EV Connect, where she held a number of roles, including head of customer experience and director of programs. During her time there, she worked with 12 manufacturers, which gave her knowledge into inner workings and common problems with the chargers.
It was here that she spotted a gap in the EV charging market.
“When the stations went down we really couldn’t get anyone on site because most of the issues were communication issues, vandalism, firmware updates or swapping out a part — all things that were not electrical,” Terry said.
And yet, the general practice was to use electrical contractors to fix issues at the charging stations. Terry said it could take as long as 30 days to get an electrical contractor on site to repair these non-electrical problems.
Terry often took matters in her own hands if issues arose with stations located in Los Angeles, where she is based.
“If there was a part that needed to be swapped out, I would just go do it myself,” Terry said, adding she didn’t have a background in software or repairs. “I thought, if I can figure this stuff out, then anyone can.”
In January 2020, Terry quit her job and started ChargerHelp. The newly minted founder joined the Los Angeles Cleantech Incubator, where she developed a curriculum to teach people how to repair EV chargers. It was here that she met Ellis, a career coach at LACI who also worked at the Long Beach Job Corp Center. Ellis is now the chief workforce officer at ChargerHelp.
Since then, Terry and Ellis were accepted into Elemental Excelerator’s startup incubator, raised about $400,000 in grant money, launched a pilot program with Tellus Power focused on preventative maintenance and landed contracts with EV charging networks and manufacturers such as EV Connect, ABB and SparkCharge. Terry said they have also hired their core team of seven employees and trained their first tranche of technicians.
ChargerHelp takes a workforce-development approach to finding employees. The company only hires in cohorts, or groups, of employees.
The company received more than 1,600 applications in its first recruitment round for electric vehicle service technicians, according to Terry. Of those, 20 were picked to go through training and 18 were ultimately hired to service contracts across six states, including California, Oregon, Washington, New York and Texas. Everyone picked to go through training is paid a stipend and earn two safety licenses.
The startup will begin its second recruitment round in April. All workers are full-time with a guaranteed wage of $30 an hour and are being given shares in the startup, Terry said. The company is working directly with workforce development centers in the areas where ChargerHelp needs technicians.
Powered by WPeMatico
Amazon is apparently pleased with how its Amazon Care pilot in Seattle has gone, since it announced this morning that it will be expanding the offering across the U.S. this summer, and opening it up to companies of all sizes, in addition to its own employees. The Amazon Care model combines on-demand and in-person care, and is meant as a solution from the search giant to address shortfalls in current offerings for employer-sponsored healthcare.
In a blog post announcing the expansion, Amazon touted the speed of access to care made possible for its employees and their families via the remote, chat and video-based features of Amazon Care. These are facilitated via a dedicated Amazon Care app, which provides direct, live chats via a nurse or doctor. Issues that then require in-person care are then handled via a house call, so a medical professional is actually sent to your home to take care of things like administering blood tests or doing a chest exam, and prescriptions are delivered to your door as well.
The expansion is being handled differently across both in-person and remote variants of care; remote services will be available starting this summer to Amazon’s own employees, as well as other companies that sign on as customers, starting this summer. The in-person side will be rolling out more slowly, starting with availability in Washington, D.C., Baltimore, and “other cities in the coming months” according to the company.
As of today, Amazon Care is expanding in its home state of Washington to begin serving other companies. The idea is that others will sign on to make Amazon Care part of an overall benefits package for employees. Amazon is touting as a major strength of the service the speed advantages of testing services, including results delivery, for things including COVID-19.
The Amazon Care model has a surprisingly Amazon twist, too — when using the in-person care option, the app will provide an updated ETA for when to expect your physician or medical technician, which is eerily similar to how its primary app treats package delivery.
While the Amazon Care pilot in Washington only launched a year-and-a-half ago, the company has had its collective mind set on upending the corporate healthcare industry for some time now. It announced a partnership with Berkshire Hathaway and JPMorgan back at the beginning of 2018 to form a joint venture specifically to address the gaps they saw in the private corporate healthcare provider market.
That deep pocketed all-star team ended up officially disbanding at the outset of this year, after having done a whole lot of not very much in the three years in between. One of the stated reasons that Amazon and its partners gave for unpartnering was that each had made a lot of progress on its own in addressing the problems it had faced anyway. While Berkshire Hathaway and JPMorgan’s work in that regard might be less obvious, Amazon was clearly referring to Amazon Care.
It’s not unusual for large tech companies with lots of cash on the balance sheet and a need to attract and retain top-flight talent to spin up their own healthcare benefits for their workforces. Apple and Google both have their own on-campus wellness centers staffed by medical professionals, for instance. But Amazon’s ambitions have clearly exceeded those of its peers, and it looks intent on making a business line out of the work it did to improve its own employee care services — a strategy that isn’t too dissimilar from what happened with AWS, by the way.
Powered by WPeMatico
For many investors, the coronavirus has effectively taken geography out of the equation when it comes to vetting new opportunities.
While this dynamic opens up startups to more investment opportunities, venture capital firms that focus on a specific region are in a thornier spot. The competitive advantage they once had when raising — the notion that they’re focused on an area no one else is — is potentially threatened.
Natasha Mascarenhas, Danny Crichton and Alex Wilhelm of the TechCrunch Equity crew discussed the future of geographic-focused funds given the uptick of remote investing:
Since 2014, Steve Case and his team have made an annual bus trip across the country to meet startups in emerging startup hubs. Five days, five cities and at least $500,000 of investment dollars given to startups. Case would even offer to fly out promising and hard-to-reach startups to have them join the trip.
The Rise of the Rest fund, with more than $300 million in assets under management, has invested in over 130 startups across 70 cities, including Austin, Chicago, Detroit, Los Angeles, New Orleans and Washington, D.C.
Powered by WPeMatico
Hello and welcome back to Equity, TechCrunch’s venture capital-focused podcast where we unpack the numbers behind the headlines.
This is Equity Monday, our weekly kickoff that tracks the latest big news, chats about the coming week, digs into some recent funding rounds and mulls over a larger theme or narrative from the private markets. You can follow the show on Twitter here, and myself here, and don’t forget to check out last Friday’s episode.
What was on the docket this morning? All sorts of good stuff, though the Sumo Logic S-1 did drop just after we wrapped. Here’s today’s rundown:
Whew, with YC and Palantir this week and a chat with Twilio’s CEO it’s going to be an active few days. Ready?
Equity drops every Monday at 7:00 a.m. PT and Friday at 6:00 a.m. PT, so subscribe to us on Apple Podcasts, Overcast, Spotify and all the casts.
Powered by WPeMatico
America’s technology industry, radiating brilliance and profitability from its Silicon Valley home base, was until recently a shining beacon of what made America great: Science, progress, entrepreneurship. But public opinion has swung against big tech amazingly fast and far; negative views doubled between 2015 and 2019 from 17% to 34%. The list of concerns is long and includes privacy, treatment of workers, marketplace fairness, the carnage among ad-supported publications and the poisoning of public discourse.
But there’s one big issue behind all of these: An industry ravenous for growth, profit and power, that has failed at treating its employees, its customers and the inhabitants of society at large as human beings. Bear in mind that products, companies and ecosystems are built by people, for people. They reflect the values of the society around them, and right now, America’s values are in a troubled state.
We both have a lot of respect and affection for the United States, birthplace of the microprocessor and the electric guitar. We could have pursued our tech careers there, but we’ve declined repeated invitations and chosen to stay at home here in Canada . If you want to build technology to be harnessed for equity, diversity and social advancement of the many, rather than freedom and inclusion for the few, we think Canada is a good place to do it.
U.S. big tech is correctly seen as having too much money, too much power and too little accountability. Those at the top clearly see the best effects of their innovations, but rarely the social costs. They make great things — but they also disrupt lives, invade privacy and abuse their platforms.
We both came of age at a time when tech aspired to something better, and so did some of today’s tech giants. Four big tech CEOs recently testified in front of Congress. They were grilled about alleged antitrust abuses, although many of us watching were thinking about other ills associated with some of these companies: tax avoidance, privacy breaches, data mining, surveillance, censorship, the spread of false news, toxic byproducts, disregard for employee welfare.
But the industry’s problem isn’t really the products themselves — or the people who build them. Tech workers tend to be dramatically more progressive than the companies they work for, as Facebook staff showed in their recent walkout over President Donald Trump’s posts.
Big tech’s problem is that it amplifies the issues Americans are struggling with more broadly. That includes economic polarization, which is echoed in big-tech financial statements, and the race politics that prevent tech (among other industries) from being more inclusive to minorities and talented immigrants.
We’re particularly struck by the Trump administration’s recent moves to deny opportunities to H-1B visa holders. Coming after several years of family separations, visa bans and anti-immigrant rhetoric, it seems almost calculated to send IT experts, engineers, programmers, researchers, doctors, entrepreneurs and future leaders from around the world — the kind of talented newcomers who built America’s current prosperity — fleeing to more receptive shores.
One of those shores is Canada’s; that’s where we live and work. Our country has long courted immigration, but it’s turned around its longstanding brain-drain problem in recent years with policies designed to scoop up talented people who feel uncomfortable or unwanted in America. We have an immigration program, the Global Talent Stream, that helps innovative companies fast-track foreign workers with specialized skills. Cities like Toronto, Montreal, Waterloo and Vancouver have been leading North America in tech job creation during the Trump years, fuelled by outposts of the big international tech companies but also by scaled-up domestic firms that do things the Canadian way, such as enterprise software developer OpenText (one of us is a co-founder) and e-commerce giant Shopify.
“Canada is awesome. Give it a try,” Shopify CEO Tobi Lütke told disaffected U.S. tech workers on Twitter recently.
But it’s not just about policy; it’s about underlying values. Canada is exceptionally comfortable with diversity, in theory (as expressed in immigration policy) and practice (just walk down a street in Vancouver or Toronto). We’re not perfect, but we have been competently led and reasonably successful in recognizing the issues we need to deal with. And our social contract is more cooperative and inclusive.
Yes, that means public health care with no copays, but it also means more emphasis on sustainability, corporate responsibility and a more collaborative strain of capitalism. Our federal and provincial governments have mostly been applauded for their gusher of stimulative wage subsidies and grants meant to sustain small businesses and tech talent during the pandemic, whereas Washington’s response now appears to have been formulated in part to funnel public money to elites.
American big tech today feels morally adrift, which leads to losing out on talented people who want to live the values Silicon Valley used to stand for — not just wealth, freedom and the few, but inclusivity, diversity and the many. Canada is just one alternative to the U.S. model, but it’s the alternative we know best and the one just across the border, with loads of technology job openings.
It wouldn’t surprise us if more tech refugees find themselves voting with their feet.
Powered by WPeMatico
At-home diagnostics startup Scanwell, which produces smartphone-based testing for UTIs, is working on getting at-home testing for the novel coronavirus into the hands of U.S. residents. The technology, which was developed by Chinese diagnostic technology company INNOVITA and has already been approved by China’s equivalent of the FDA and used by “millions” in China, can be taken at home in 15 minutes with the guidance of a medical professional via telehealth, and produces results in just hours.
Scanwell’s test will require FDA clearance, but the company tells me that it’s in the process of securing approval through the FDA’s accelerated emergency certification program. The FDA guidance says that this approval process should take 6-8 weeks (though that “could be faster,” Scanwell says), and Scanwell is aiming to be ready to go with shipping these as soon as it receives that approval. While the U.S. drug regulatory agency previously had only included PCR tests in its protocols, it updated that guidance to include serological tests earlier this week. Scanwell further says they “don’t anticipate any issues with FDA approval.”
The test that Scanwell is aiming to launch uses what’s called a ‘serological’ technique, which looks for antibodies in a patient’s blood. These are only present if someone has been exposed to the SARS-CoV-2 virus, since as of right now researchers haven’t found any evidence that natural antibodies to this particular virus exist without exposure. By contrast, the types of tests that are currently in use in the U.S. are “PCR” tests, which use a molecular-based approach to determine if the virus is present genetically in a mucus sample.
The PCR type of test is technically more accurate than the serological variety, but the serological version is much easier to administer, and produces results more quickly. It’s also still very accurate on the whole, and is much cheaper to produce than the PCR version. Plus, it could help expand efforts beyond testing only the most severe cases with symptoms present, and do a much better job of illuminating the full extent of the presence of the virus, including among people with mild cases who have already recovered at home, and those who are asymptomatic but carrying the virus with the possibility of infecting others.
Also, while other, PCR-based at-home testing options already exist, like one from Everlywell that will start going out on Monday, require round-tripping test samples, adding time, complexity and cost and relying on testing materials like swabs that are in short supply globally.
Once the test is available, people deemed eligible via Scanwell’s screening process in their Scanwell Health app will be sent the test via next-day delivery. They’ll be guided by telehealth partner Lemonaid‘s licensed doctors and nurse practitioners, and they’ll then receive results and further guidance about those results via the app within a few hours. The whole testing process will cost $70, which Scanwell says just covers its costs (it’s also looking at ways to provide free service to those who need it), and will be deployed first in Washington, California and New York, as well as other areas depending on the severity of their coronavirus situation.
That the tests will take potentially 6-8 weeks to come to market seems like a long time, given the current state of the rapidly evolving COVID-19 situation and testing. But we’ll likely still be very much in need of testing options at that time, especially ones that can serve people who aren’t necessarily meeting the criteria for other available testing resources.
Powered by WPeMatico
Have we got a Cyber Monday deal for you. TC Sessions: Robotics+AI (March 3) and TC Sessions: Mobility (May 14) are coming back to California in 2020, with early-bird tickets starting at $275 and $250 respectively. But if you buy your pass today, you’ll save an extra 15% on each event. How sweet is that?
Don’t delay, startuppers. Buy your pass to TC Sessions: Robotics+AI and/or TC Sessions: Mobility before this one-day deal expires promptly tonight at 11:59 pm PT.
Oh, and did we mention that all startup exhibitor tables are also 15% off? Tables are good for early-stage startups and come with four (4) tickets and demo area at the conference. Book your table for Mobility here or one for Robotics here.
It doesn’t take artificial intelligence to recognize great opportunity, and you’ll find plenty of it at our day-long exploration of the latest issues, trends, tech and products in robotics+AI and mobility. At each of last year’s events, 1,000+ of each category’s top minds and makers gathered for live interviews, demos and workshops featuring world-renown technologists, founders and investors — not to mention world-class networking.
Past Robotics+AI Speakers:
Past Mobility Speakers:
We’re just getting started on building out the event agenda and we’ll announce plenty more speakers and panelists over the coming months, so keep checking back.
Mark your calendar, join us at UC Berkeley on March 3 for TC Sessions: Robotics or come to San Jose on May 14 for TC Sessions: Mobility and spend an entire day with the best and brightest minds and makers. Don’t miss this Cyber Monday opportunity to save an extra 15% on tickets to TC Sessions: Robotics+AI and/or TC Sessions: Mobility.
Powered by WPeMatico
The maker of Magic: The Gathering has confirmed that a security lapse exposed the data on hundreds of thousands of game players.
The game’s developer, the Washington-based Wizards of the Coast, left a database backup file in a public Amazon Web Services storage bucket. The database file contained user account information for the game’s online arena. But there was no password on the storage bucket, allowing anyone to access the files inside.
The bucket is not believed to have been exposed for long — since around early-September — but it was long enough for U.K. cybersecurity firm Fidus Information Security to find the database.
A review of the database file showed there were 452,634 players’ information, including about 470 email addresses associated with Wizards’ staff. The database included player names and usernames, email addresses, and the date and time of the account’s creation. The database also had user passwords, which were hashed and salted, making it difficult but not impossible to unscramble.
None of the data was encrypted. The accounts date back to at least 2012, according to our review of the data, but some of the more recent entries date back to mid-2018.
A formatted version of the database backup file, redacted, containing 452,000 user records. (Image: TechCrunch)
Fidus reached out to Wizards of the Coast but did not hear back. It was only after TechCrunch reached out that the game maker pulled the storage bucket offline.
Bruce Dugan, a spokesperson for the game developer, told TechCrunch in a statement: “We learned that a database file from a decommissioned website had inadvertently been made accessible outside the company.”
“We removed the database file from our server and commenced an investigation to determine the scope of the incident,” he said. “We believe that this was an isolated incident and we have no reason to believe that any malicious use has been made of the data,” but the spokesperson did not provide any evidence for this claim.
“However, in an abundance of caution, we are notifying players whose information was contained in the database and requiring them to reset their passwords on our current system,” he said.
Harriet Lester, Fidus’ director of research and development, said it was “surprising in this day and age that misconfigurations and lack of basic security hygiene still exist on this scale, especially when referring to such large companies with a userbase of over 450,000 accounts.”
“Our research team work continuously, looking for misconfigurations such as this to alert companies as soon as possible to avoid the data falling into the wrong hands. It’s our small way of helping make the internet a safer place,” she told TechCrunch.
The game maker said it informed the U.K. data protection authorities about the exposure, in line with breach notification rules under Europe’s GDPR regulations. The U.K.’s Information Commissioner’s Office did not immediately return an email to confirm the disclosure.
Companies can be fined up to 4% of their annual turnover for GDPR violations.
Powered by WPeMatico