[Closed] SUPERSTAR WARNING!!! SUPERSTAR WARNING! PLEASE READ!!!!!!!

On the last bit. Sales of goods act should apply?

It should but I'd rather know beforehand what their plan was, if it involves posting it across Europe/Taiwan to confirm if it's an issue before thinking of refunding, replacing weeks/months later I'd walk away. Sale of Goods act in the end is there for when things go wrong. I'd rather not get to that point. Also the letter from Pure was interesting - would like to see a KS response for it.

From the T&C's on warranty

Warranty
All parts bought from Superstar Components come with a 2 year warranty guaranteeing parts are free from defects in materials or workmanship for a period of two years after original purchase unless otherwise stated below. The warranty is non-transferable and valid to the original purchaser of the product only, proof of purchase will be needed so don’t throw away your receipts/invoice.
Like all guarantees this does not mean that all parts are indestructible. This warranty does not cover wear and tear or damage caused by crashes, bike transport, improper use or poor installation. Cyclists should regularly check they bike for damage and that parts are correctly installed.
All parts have a finite lifetime and this is determined by the manner the part is used, maintenance and conditions of use.
1. All cartridge bearings have a finite lifetime. Bearings that fail due to contamination, misuse, improper installation, or lack of maintenance are not covered under warranty even if failure occurs within two years from date of purchase.
2. Parts which have been modified, neglected or poorly maintained are not covered under warranty
3. Damage from causes other than defects in materials and workmanship such as a user’s lack of skill, competence or experience is not covered under warranty.
4. The finish or aesthetics of the product are not covered under this warranty.
5. Normal wear to the product is not covered under warranty. Components may have symptoms of wear in less than two years depending on amount of use, type of use and other conditions. This includes products that have reached the end of their normal life expectancy.

This does not affect your statutory rights.

Also worth noting....

Pricing

Prices include VAT (Value Added Tax)* at the standard UK rate of 17.5%. VAT does not apply to orders that are to be shipped outside the E.U. or to Tax Free areas such as the Channel Islands. These areas will be priced and billed with VAT deducted automatically.

For sticking (main) issues I imagine hes used to clean/regrease of these himself. Anyway enough defending. Im looking like a sycophant.

Hmmm. I log in and see someone else. Bit odd I must say. He bought a dropper post today!

I went tot he site and a Lev appeared in my basket and it said I was logged in.

Then something else got added when I tried to add a lev. And then some more funny goings on.

I am now in my account with a lev in my basket.

andyl - Member
I went tot he site and a Lev appeared in my basket and it said I was logged in.

Then something else got added when I tried to add a lev. And then some more funny goings on.

I am now in my account with a lev in my basket.

So am I

Woud it be safer if I bought stuff from Superstar using Paypal Gift?

You'd get [I] shafted? [/I]?

Woud it be safer if I bought stuff from Superstar using Paypal Gift?

Maybe just wait until tomorrow when everybody will go back to work and any problem will be sorted as i am sure they will have plenty of reports in their inbox!

Or of course rush an order through now and then moan a week later when your details are showing up somwhere they shouldnt...

This thread can be summed up in 7seconds [url=

No problems at all here. Just ordered a chain guide. Oh and for the record Superstar have always been super-quick to reply to any email queries.

+1 here for Superstar.

Looking forward to receiving someones dropper-post soon. 😀

I have never ordered anything from Superstar or even logged into the Superstar website.
My bargain dropper seatpost has still not arrived, who do I complain to?
How can they let this happen??

Just logged in and got someones details and order history here 😕
Think i,ll leave that one until tomorrow.

I hope somebody (especially those claiming to know the guys) have given them a call and told them that their website is spewing customers details out all over the place and needs to be taken off line before they get in trouble.
From their Facebook 3hrs ago

Superstar Components Hello the office closes at 5pm so you won't get through. I've checked the site on several computers and cannot find an error. It looks like the server had a glitch and spat out the wrong session to a few people due to hundreds of people logging on for the special offer at exactly the same time.

We apologise for any confusion and can confirm that nobody can charge you or order things on your behalf because all our payments are handled offsite by PayPal.

I'll check up on this tomorrow as I can find any issues currently

I'm Luke B *waves*

Are you the emo kid who was on here all the time years back? Along with 'Big Mike AKA Mike' who I believe was another kid with hormone problems who also spent too much time on the Internet?
I did wonder if they turned into normal people after those tumultuous teenage years?
And was it you who got your friend to sign up even though she didn't own a mountainbike? Her name was louisa bliggy?

Apolagies if I have the wrong LukeB.

When this happened on the gamestation website they started giving out £100 vouchers to people reporting it. They can get in a lot of trouble

ANDYRM

and believe me, those details simply are not in the hands of an online retailer.

is that correct?

i thought about 99% true - all retailers use a merchant to process credit card transactions and smaller retailers are simply linking you to the merchant (paypal, nochex, hsbc etc) website where the transaction is processed and then the merchant site flags back to the retailer saite that the transaction has happened - thats why most small retailers take payment at time of order

large retailers offer you the convenience of storing credit card details (some infamously some not) eg Amazon, CRC, Wiggle, NEXT = my understanding is that this info is directly stored by the retailer - albeit the systems set up has to meet the merchants security criteria - gives customer convenience and billing when that back order item eventually turns up

oh yes the thread title is OTT, the explanation of what info was being displayed too vague to start with

Yep - effectively what happens is the website transfers you to the Paypal "till" with a note saying how much you owe. You pay this to Paypal. Paypal confirm to retailer you have paid, and return you to retailer website, with the retailer never seeing the card info at all.

Revenues are then instantly in the retailer's Paypal account, less Paypal's commission.

Believe me, Paypal security is super tight. And by it being like this, the odds of a CRC style hack of stored cards is much lower as the retailer never had them.

Yep It's expected that no CC details were let out but names address and phone numbers along with order history, ie failure of the log in process should have been sorted out when they knew about it not leaving it till the morning to sort out.

I agree. That could have at least been worded better ''will look into this asap' even if you meant secretly you werent til first thing.

and believe me, those details simply are not in the hands of an online retailer.

is that correct?

Believe me, Paypal security is super tight. And by it being like this, the odds of a CRC style hack of stored cards is much lower as the retailer never had them.

don't really understand answer - yes I believe Paypal security is very good - and that SSC use Paypal to process transactions so they fall in the 99% of "smaller" businesses that never hold card data

but i'm not sure on "the never in the hands of a retailer" - i believe this isn't the case for some large retailers - the data may not be readily accessed by employees but sits on the retailer side

Are you the emo kid who was on here all the time years back? Along with 'Big Mike AKA Mike' who I believe was another kid with hormone problems who also spent too much time on the Internet?
I did wonder if they turned into normal people after those tumultuous teenage years?
And was it you who got your friend to sign up even though she didn't own a mountainbike? Her name was louisa bliggy?

*waves*

I turned out as reasonable as could be expected.

And I'm just [i]a[/i] Luke B, not [i]the[/i] Luke B.

it is a classic case of blowing something out of proportion.

= classic case of pot calling kettle...

I would join in but I've just dislocated my jaw with yawning... 😯

What you doing typing with your jaw.......confubulator lessons for you I'm afraid! 😉

http://www.backupdirect.net/data-protection-act-summary

As my dad found out recently all that the scum out there need is a name, address and telephone number to aquire a mobile phone from Vodafone. Took 4mth to sort that out with a visit from the debt collectors threatened!!

So although it might not look serious it is 😯

However whether it be human nature, mechanical or digital incidents like this will always crop up 🙄

If card data is held, merchants generally comply with the standards laid down in the PCI DSS (Google it). Compliance is verified via internal and external audit during test/deployment.

In this case the card data will be held by PayPal who will be fully PCI compliant. I wouldn't get too excited though, some of the PCI compliant systems I've seen haven't been very clever at all.....

As for sharing confidential data (name, address etc), this may fall under the data protection act and if I were Fruit, I'd be very concerned about contravening that as porridge and/or massive fine are likely outcomes.

What boblo says. Mrs T is awaiting the outcome of an investigation at her place of work 😐

He does seem to have changed his tone a bit on Facebook. As boblo said - his biggest worry is going to be if there's any subsequent data protection fallout for him.

I do find it odd - if CRC/Wiggle/etc were spraying random peoples names addresses and order details out to all and sundry I suspect there'd be less 'he's a nice chap, let's keep it quiet and let him sort out in his own time' type responses.

After their facebook was quiet about it I posted a link to this thread, he nicely deleted it this morning.

In all seriousness the sensible thing would have been to pull the plug and put a holding page up till you worked out what was going on. Especially given the Data Protection aspects which are very serious. But I guess if you were trying to get shot of a load of KS posts super quick....

In case anyone is counting, what treckster said about name, address & number happened to me. It killed off my existing mobile when I was far from home. It was then not easy to sort.

I think the lynch mob need to settle down now. SS have posted on their FB that they are investigating.

Wait till the outcome of that and establishment of facts as to what happened and corrective measures in place.

Tech outages are always going to happen - and given the STW IT worker demographic, I'm sure you all know that.

[i]establishment of facts as to what happened[/i]

the [b]*facts*[/b] are that I saw several other peoples personal details and mine were viewed by other people.

'outages' are where systems goes down, not when sessions and baskets are randomly assigned to users who are nothing to do with them.

You're not from around here are you boy.

That's not how things happen in these here parts.

wwaswas - our definition of 'outage' at my work is any systems failure. Please accept my humblest apologies for using a different word to your first choice, but you know what I mean 🙂

I like superstar gear and will continue to buy it despite idiotic threads like this one.

the issue is you still seem to be questioning what the 'facts' were when there been a lot of people reporting the same breach of data protection laws across a 5 or 6 hour period.

I think the lynch mob need to settle down now. SS have posted on their FB that they are investigating.

Unlike last night when they said sorry we have gone home and wait till the morning while our website continues shares your details with random strangers.

Websites spewing info out to random people which potentially may have exposed a gaping hole in our security set-up is generally one of those when you sort it out rather than go home.

Tech outages are always going to happen - and given the STW IT worker demographic, I'm sure you all know that.

From a tech/it perspective it's more of a **** up than an outage.

Not sure why you're fixating so much wwaswas - it's been stated on their FB that they are investigating. Sometimes things go wrong. They are investigating with a view to a fix. End of story. Move on.

as porridge and/or massive fine

Half right - unlimited fines, not prison for accidental breaches, even if blatant negligence is the cause.

We've had a ICO investigation after andaccidental DPA breach, it'll likely come down to what was in place and how seriously the protection of data was taken:

If they had tried to do things right, had policies in place and processes that should have kept private data private, but something went wrong with them, probably nowt to worry about assuming that the issue is dealt with promptly and capably.

If they had never given a thought to security of private data, had nothing in place to protect it, no policies or person taking responsibility then problems aplenty from the ICO...

For the ICO to even take it half seriously though, there would have to be evidence that the breach was likely to cause harm (including distress) to the subjects whose data leaked, it's not necessarily meeting that threshold just from another cyclist getting a fleeting glimpse at your shopping basket tbh

Not sure why you're fixating so much wwaswas

Hmmm. The words kettle, pot and black spring to mind. Do you really have no connection with Superstar?

[i]Not sure why you're fixating so much wwaswas[/i]

I'm equally not sure why you're insisting on posting on and trying to police a thread about an event that didn't involve you and for which your sole criteria seems to be 'I rode with him once and he seemed like a nice bloke'?

Random strangers were presented with my personal details. I feel that saying 'maybe just buggering off home and ignoring the problem was inappropriate' is a reasonable stance to take.

I also note that they are still accepting orders and allowing people to use the site despite now knowing that they are breaching data protection laws. That's not an 'outage' that's illegal.

Anyway, perhaps you should move along and let those of us who might feel aggreived at the approach taken to our personal data air our views?

Not sure why you're fixating so much wwaswas - it's been stated on their FB that they are investigating. Sometimes things go wrong. They are investigating with a view to a fix. End of story. Move on.

Normally when people (I) say that they are (I am) investigating the issue it means I'm still having my breakfast and until I make a second pot of tea would you leave me alone. It could also mean I have no idea how this ****ed up or what has actually happened and pass me another tea and some hob nobs while I make it look like someone elses fault

I was on their website yesterday buying some pads at around lunchtime without a problem. You have obviously had an issue (which in my opinion is a minor one) and have chosen to use that to try and damage someone's business for some reason.

Your headline is ridiculously out of proportion and your ongoing comments seem a bit tinfoil hat if you ask me. I can get your name and address out of the phone book.

I just logged in and there is no problem.

edlong - Member
For the ICO to even take it half seriously though, there would have to be evidence that the breach was likely to cause harm (including distress) to the subjects whose data leaked, it's not necessarily meeting that threshold just from another cyclist getting a fleeting glimpse at your shopping basket tbh

But this isn't shopping basket data is it? It's personal data (names, addresses, phone numbers). The fault was found yesterday at 16:00? and the site is still up. 'Normally' the site would be taken offline and a maintenance page put up whilst its sorted. That would be regarded as reasonable action. Ignoring it and continuing to trade is not.

Grum - absolutely not mate, I just hate seeing these kind of lynchings, especially when a lot of the thread content seems to be driven by an old grudge for what some perceive to have been a slight against STW some time back. I might be accused of being a bit of a devil's advocate in this thread perhaps - but just presenting a point of view that I hold, given I work in an industry that has to be on the receiving end of customer's online complaints, and having seen people getting disproportionately upset.

Oh and I just put an order through, so if anyone sees my details pop up for 2 x 4 packs of Kevlar pads (one bundle for Saint/Zee and one bundle for Avid), a Flatland 780 bar and a 183-203 F brake adaptor going to Bristol, that's me. Oh and the address is for my office in case any of you are burglars hoping to rob all my bikes! 😉

Anyway, perhaps you should move along and let those of us who might feel aggreived at the approach taken to our personal data air our views?

We're going to have to disagree here. I'm not for one second saying you are wrong for being aggrieved. I am however saying that some of the responses on this thread do seem disproportionately emotionally loaded and worried. I'd expect someone to be able to accept (as I do) that there might be another point of view than my own. Just saying.

[i]I'd expect someone to be able to accept (as I do) that there might be another point of view than my own[/i]

but you still type;

[i]End of story. Move on. [/i]

as if your view is the only valid one.

tbh, I am a bit pee'd off that other people saw my details but I'm not overly concerned about it as a one off event. I was probably as annoyed by the OP putting my name in the thread.

I am concerned that there may be security issues with his software beyond what we've seen that would allow a more directed attack deliver significant quantities of personal data to those chosing to do it.

I don't feel I've been over emotional or disproportionally upset but, equally, I'm not just going to stop posting on a thread because someone unconnected with the business says 'they've made a statement on facebook so it's all over now'

If those who feel this thread is too much stopped posting I suspect discussion would die down and it woudl drift off the front page.

why does andyrm refer to him/herself in the third person?

SSC have history and its not glorious

this thread was best summed up by "i once vowed never to use them again but got sucked in by a bargain"

andyrim - take heart, the bargain basement marketing ploy worked. suggest you add the IT systems to the long list of stuff needing fixed.

It seems to me that user session data is getting "leaked" to other users (as mikewsmith mentioned), not sure how that'd happened unless it's cache related which would be backed up by cheap dropper posts = higher load and has actually been a bug all along but only now been detected.

IMO the site should have been taken down when the bug was reported by multiple users and stayed down until fixed. If I'm correct then I'm not actually sure what else superstar could have done as it'll be a bug in software, they certainly should have knocked the site down though.

FWIW I've just ordered a pair of grips from then anyway...

why does andyrm refer to him/herself in the third person?

SSC have history and its not glorious

this thread was best summed up by "i once vowed never to use them again but got sucked in by a bargain"

andyrim - take heart, the bargain basement marketing ploy worked. suggest you add the IT systems to the long list of stuff needing fixed.

soobalias - I suggest you speak to Drain off here (link to his profile: http://singletrackmag.com/forum/profile/drain ) who I am sure will be happy to confirm that when he met me in person at Bristol Temple Meads to pick up some brakes, I was me, not Neil from Superstar, and that the payment details he used to pay me for the Maguras were in my name, not someone elses. Good attempt though, but next time, try and make accusations that are factually correct 🙂

But this isn't shopping basket data is it? It's personal data (names, addresses, phone numbers). The fault was found yesterday at 16:00? and the site is still up. 'Normally' the site would be taken offline and a maintenance page put up whilst its sorted. That would be regarded as reasonable action. Ignoring it and continuing to trade is not.

Names and addresses are not sensitive personal information. In fact, the ICO gives this as a specific example of something that is NOT reportable as it doesn't contain sensitive personal information. Add in NI numbers, dates of birth or similar, then you've got a serious breach of the DPA that needs to be reported to and investigated by the ICO, but if it's names, addresses and phone numbers only then it really doesn't meet the threshold, in fact for anyone who's not ex-directory, it's public domain already (the phone book).

While a bit embarassing for SS, those of you getting in a froth about the DPA, massive fines and talk of imprisonment need to calm down, acquaint yourself with how the ICO / DPA actually work (the ICO website is really helpful) and stop trying to equate this with serious losses of sensitive personal information, which it clearly isn't.

As a bit of perspective, I was involved with a ICO case where an organisation had lost a laptop, which was not effectively secured, and the hard drive of which contained information about individuals which included sensitive medical information. They had things in place that should have prevented the data being accessible, but those things didn't work in that instance due to a combination of factors, and they took prompt and reasonable action to manage the incident. The ICO took no action.

Did the lappie have a remote self destruct button? 🙂

we had one of those ed. I found out who security had to tell and made sure nothing ever left my sight ever again 🙂

My worry was more that the info presented was the symptom of something worse.The assumption was that it was to do with the e-mail but there is always a chance of hacking. Hence why suggesting the site should have been taken down.

Jeez, just started reading this thread and thought for a moment it was going to say Superstar had run out of Haribo's!!!

Panic over.

Jeez, just started reading this thread and thought for a moment it was going to say Superstar had run out of Haribo's!!!
Panic over.

🙂

I think they may have. A set of superstar canti pads arrived today - no hairybaws

As my dad found out recently all that the scum out there need is a name, address and telephone number to acquire a mobile phone from Vodafone.
So although it might not look serious it is.

Phone book, directory enquiries?

Random strangers were presented with my personal details

What personal details are these exactly?
Name and address? Anything more than that?

If it was just name and address I can't see the problem. My postman sees mine every day.

Can't comment on ICO compliance, but in terms of best practice, any organisation that I have worked for would regard displaying customer details to the wrong customer as a very serious incident.
I have always been advised that any data that uniquely identifies an individual is potentially sensitive. So a name on it's own, no problem. Name with address, potential issue.

"Oh, I can see Mr Smith of 10 Main Street is buying a dropper post and a load of disk pads. Hmm. I wonder what Mr Smith might have in his garage at 10 Main Street?"
Not sensitive?

Sure, your postie sees your Wiggle boxes being delivered, but there will be processes in place to mitigate that risk. I'm not suggesting that the company in this incident has been negligent. Things go wrong, and I'm sure they are doing their best to fix the problem (and may already have done so). Showing customer details to the wrong customer is still a serious incident for any company that takes its reputation seriously.

The simple fact of it is that "Mr Smith lives at wherever" isn't sensitive. But the clincher is that Mr Smith whop live here, has bought things from This Shop. That becomes 'Sensitive'. Even before email addresses and phone numbers are disclosed. Basic notion being one rule must fit all in such scenarios, and so there can be no difference in law if Mr Smith has bought brake pads and a dropper from superstar or he has bought a blow up doll, 4 butt plugs, an SS uniform and some poppers from Loveitupyourarse.co.uk - revealing either of these is viewed the same way, so as to protect against any judgement of what is or isn't shameful/proper etc. To be honest that is fair enough. Mr smith has the right to put kevlar pads up his bottom in the privacy of his own room before donning his ss uniform and shredding the local woods.
It is not the information that is bad, but the fact that the origin of it reveals information about the person.
It hasn't stopped me from buying SS today. Though I do limit what I buy from SS based on the fact I'm yet to hear of one uncontested warranty claim - ever.
I do also suspect it is this and other similar things that result in such witch hunt subtexts to threads.
Hope have (as has been shown on these pages) a lot of warranty claims, but then they sell a lot of stuff, only they know the true figures behind it, but they deal with warranties in a way that has people singing their praises. But they also are not a budget brand, and aren't so close to the bottom line as I imagine SS operate at so maybe a more lenient attitude doesn't threaten the business and they feel they can take the longer view.

Not sure what my point is, other than, "Sings and Roundabouts, init".

Tried loveitupyourarse.co.uk but got nothing

Like I'm actually going to infringe my own privacy and tell you were I buy my double penetration masochistic threesome dolls and animal sounds tapes...

Well, for what its worth, Neil/Superstar have been in contact a few times today, basically they/he seems to think its a small minority of people from a short period of overloading on their website. As many people have pointed out including Neil/Superstar many of the details may be available in the public domain...

However, I stand by my initial distress and confusion as to what was actually happening to my details, the extent of which I (being a non IT/Banking technical expert - unlike many of the quite unsavoury keyboard warriors on here.) had no idea.

I also would like to point out I have NO problem with Superstar (hence being on the site in the first place to actually buy something - or did that slip your oh so big minds!) I do not work in the cycling industry atall and never have done. I DO have a problem with any company bar none who have a security breach for whatever reason resulting in my data being leaked when it was left in good faith - see the DATA PROTECTION ACT!

To all the people who I see/read on here who have become offensive with regards to OTHER peoples data being sent around. Why dont you post your Names and addresses, phone numbers and emails and any other details for the world to see.

No.

I didnt think so.

Now I shall return to just riding my bike. I knew there was a reason I didnt "log in" very much.

Hope to never see a few of you on the trails. Im sure the feeling will be mutual. I apologise to the named person, never meant to cause you distress either, just to inform you/ others. Over. 😐

FYI I have never bought anything from superstar components and am unlikely to buy anything from superstar components in the future so please do not suggest otherwise.
Thanks.

Mr Smith has bought brake pads and a dropper from superstar or he has bought a blow up doll, 4 butt plugs, an SS uniform and some poppers from Loveitupyourarse.co.uk

Well, for what its worth, Neil/Superstar have been in contact a few times today, basically they/he seems to think its a small minority of people from a short period of overloading on their website.

Has he stated that he intends to investigate/fix the problem?

Yes but that was way back on page 2. You may have missed it in in the outrage.

HOW DARE YOU MISS IT IN THE OUTRAGE! THAT'S OUTRAGEOUS! APOLOGISE!

ROYAL MAIL WARNING! ROYAL MAIL WARNING! PLEASE READ!!!!!

Very disturbed to report that when I got home from work, I had SEVEN letters on my doormat. This means that not only do Royal Mail have my personal details (name & address), but in a few cases, because of sender addresses being on the back, THEY KNOW WHO IT WAS FROM! Firstly, who do I complain to? Secondly, I need to warn all of STW that Royal Mail possibly have your details too.

To further compound the issue, the postman* has seen me on my bike at least once recently. This means that not only does he know where I live, he also knows my name and that I have a bike. What are my rights?

*note: he was struggling a bit with the weight of his post bag so I also would like to warn all of STW that he is clearly "not fit for purpose".

So you're happy to put your name, home address and phone number on this thread to prove it's not a problem for people to know it?

Also, for someone who wants this to go away you seem to be bumping the thread on a regular basis?

It's yesterdays news now, anyway, and as someone familiar to you posted earlier.

End of story. Move on.

Waswas - here you go! I'm not worried, it's out in the public domain anyways.

Andy Nelson
44 Stevens Crescent
Totterdown
Bristol
BS3 4UJ

And I thought the last couple of comments before mine were pretty funny, hence replying. Sorry for any offence caused by replying with a little bit of humour 🙂

[img] [/img]
AndyRM earlier

RM is that the Royal Mail, were you the postman do you deliver your own letters..

Anyway those who don't care that your name, address, phone number and e-mail were shown to others paste them here now.

Also as the issue wasn't resolved very quickly what other security holes were opened?

Hope to never see a few of you on the trails. Im sure the feeling will be mutual. I apologise to the named person, never meant to cause you distress either, just to inform you/ others. Over.

^^^Flounce!!

RM is that the Royal Mail, were you the postman do you deliver your own letters..

I'm definitely not a postman.

Still I am quite chuffed to have been implied to be both a bike part manufacturer boss and also a postman in 24 hours. If only there were enough hours in the day 😀

And I thought you were just an opinionated pseudo expert on data collection/sharing/protection and sometime enthusiastic defender of Fruit and his empire.

Now if Fruit were really good at customer service, he'd come here and explain what went on and what he's done to ensure it's fixed and never happens again.

Dismiss it all you like, sharing data like this is not what competent, professional organisations seek to do.

no phone number or email Andy?

Who paints their house turquoise?

😉

the wall ties need some attention too - cracks in those places probably mean there's a bit of movement.