I assume that BuyVIP was smart enough to only store encrypted passwords, but I am sure that brute-force attacks can retrieve some of these passwords. Worse yet, you as a customer can be sure that your data is now being traded in some shady messaging boards.

Here is the German text BuyVIP sent to its users:

“Sehr geehrtes BuyVIP-Mitglied,

Wir möchten Dich heute darüber informieren, dass es möglicherweise zu einem nicht autorisierten Zugriff auf einige Deiner BuyVIP Kundendaten einschließlich Name, E-mail Adresse. Versandadresse, Geburtsdatum, Telefonnummer sowie dem geschützten Passwort gekommen ist.

Zahlungsinformationen, einschließlich Kreditkarteninformationen, sind nicht betroffen.

Obwohl wir Passwörter in verschlüsselter Form speichern, empfehlen wir Dir als zusätzliche Vorsichtsmaßnahme, Dein Passwort für das BuyVIP Online Portal zu ändern. Diese Empfehlung gilt auch für andere Webseiten, für die Du das gleiche oder ähnliche Passwörter benutzt.

Weiterhin möchten wir Dich darauf hinweisen, dass BuyVIP Dich niemals nach persönlichen Daten oder Log-In und Passwort per E-Mail fragen wird. Solltest Du E-Mails erhalten, die persönliche Daten abfragen oder auf eine Webseite verlinken, auf der Du persönliche Daten angeben sollst, behandle diese bitte mit Vorsicht.

Wir mochten uns bei Dir für die Unannehmlichkeiten entschuldigen.

Falls du derzeit eine Bestellung bei uns offen hast, wird diese von unserem Team weiterhin bearbeitet und Dir wie vereinbart geliefert.

Dein BuyVIP Kundenservice.”

Well,  first of all they should have informed their users earlier if their website was offline for a few days already. But still, they might have needed some time to figure out what went wrong. Really bad I believe is the fact that they are trying to hide this public relations GAU (German for worst-case scenario) from the public! They only inform users with an email, there is no mentioning on other channels, such as their Facebook page, their Twitter account  @clubshopping, their blog http://www.insidebuyvip.com/ or their press page.

I am not the only affected person in the world – just do a quick search on Twitter for #buyvip. Apparently, users are already deleting their accounts.

When I tried to contact BuyVIP on their Facebook page asking them politely why there is so little information, THEY DELETED MY FACEBOOK COMMENT! This is ridiculous, a consumer Internet company that has severe security breaches and lost personal and sensitive user data is purposefully hiding from the public and deletes questions on the matter on Facebook. Very bad PR style. Here is the proof, very lame response in my opinion:
To be fair, it seems that they simply set up the Facebook wall, so that non-BuyVIP posts are moved up, while all others are moved down. So no deleted posts after all. Still, why is there no mentioning of this incident on Facebook? Why do they only send a mail, why on Friday night when few people are active online…?

I hope this bites them back. I will probably follow suit and do what most Twitter users did, delete my account with them. If you were hit, make sure not to respond to weird emails asking for your password and change your password if you used it somewhere else…

Update 2011-09-10:

So far I have not been able to find any public statement by BuyVIP and I assume the fact that the media hasn’t picked up at all on this story – unlike the T-Mobile data theft or the very recent Sony hack (German article and English article) – is the “perfect timing”. However, it seems that their whole user base is affected, which means that we are talking about roughly 6mn users!! This is an incredible number given the amount of information the hackers stole. From Twitter and Facebook comments it seems that many users’ data was deleted entirely or personal information was changed. When I logged into my account, my address and phone number was gone and my birth date and home town was changed to some ridiculous values. This could be an indication that backups are not available, why else would BuyVIP switch on their site again with the fake and incomplete data, if they would have had the real data as backup. Bad for them, because not only do they need to regain the trust of their users (many are cancelling accounts according to angry tweets), they also might have to get users to re-enter their data. Will be a tough task…

At the same time, it seems that this is really an international issue since blogs in Poland or Spain are talking about the same email. I wonder whether these emails also had the seemingly innocent email subject “Information zum BuyVIP Online Portal” which translates as “information regarding the BuyVIP online portal”. A fitting subject line according to the gravity of the issue. I am sure that there is a vast amount of users who just deleted this email, because they might have thought it is just another shopping deal newsletter.

This is a great opportunity for anyone interested in entrepreneurship to find out about anything related to venture capital from people working in the industry. The event is quite casual and anybody interested in the topic is invited. However, since spaces are limited, you should send a short pitch (e.g. an executive summary or a video explaining your idea) to the email address techbrunch@targetpartners.de to apply for a free ticket. Be quick, the last few times available spaces went fast.

If you have questions about the process, feel free to contact me directly via email (or through a comment here). Participants from Target Partners will be myself as well as Olaf Jacobi, whose blog www.olafjacobi.de you might want to check out as well!

Now, the big question was which social features are important and how I can I integrate them as easily as possible. The most ubiquitous social sharing feature seems to be Facebook like button. Additionally, many sites offer “share on Facebook” and “post on Twitter” buttons, which I will discuss as well later in this article. Finally, I will also explain some points regarding other easier options using external service providers.

Facebook Like Button

A Facebook Like button can be integrated by visiting this Facebook page. Follow the instructions on the page titled as “Step 1″. Basically you have to enter the URL “to like” as well as some styling details. I entered some details for this very website www.schollmeier.info and got the following code snippet

Including this code in the HTML of this article yields the following:

Quite easy, isn’t it? Well, it gets easier.

Share on Facebook

Facebook offers a special URL that can be used to share any page on Facebook. The magic URL is called: http://www.facebook.com/sharer.php

However, without the proper parameter this link is not useful. The URL takes two parameters, u for the URL/link of the document to be shared, and t for the title of the document to be shared. So, if we wanted to create a button or link to share this blog on Facebook, the resulting code would be:

http://www.facebook.com/sharer.php?u=http://www.schollmeier.info&t=Bloggin la vida loca

If you want to include this link on your website, simply modify the two parameters. You can then use the <a> tag to create a sharing button or link. In our case this could look as follows:

Share on Facebook

Post on Twitter

Creating a post on Twitter button is as easy as creating a share on Facebook button. Twitter also offers a URL to directly post a status to Twitter. The link is simply:

As you can see, you are able to post a status by modifying the status parameter in the URL above.  Knowing this you can create as many different buttons as you like, such as:

Share on Twitter

Other sharing options

Other options are also available, especially for webmasters that do not want to fiddle in their code. Personally, I like the service offered by AddToAny. It offers a number of options to customize the share button and you even have the option to pick from a large number of Add2Any plug-ins for Drupal, WordPress, etc.

I used the Add2Any form to create a quick share button for this very button and generated the following code:

Implementing this code yields the following button:

An alternative good service is the AddThis which has the advantage – over Add2Any – that users have advanced analytics!

Icons & Co.

Finally, you will need some good icons if you do not want to use pre-packaged sharing services. Personally, I very much like the two icon sets by wpzoom. They offer two icon sets that are offered under the Creative Commons License for free, the social networking icon set and the developer icon set. Try them out, they are great!

Feel free to comment on this article or contact me directly if you have any questions.

I am part of the team organizing the next TechBrunch in Karlsruhe (the first one took – where else – place in Berlin) and we are now ready to receive applications from interested parties. Date is the 5th of April from 9am to 12am. Brunch/breakfast costs are covered by us. For more info, please check the TechBrunch website.

On October 18th, I visited the QS MBA World Tour in Munich where I talked to some prospective students about my experience at IESE Business School and the MBA studies there. I can only encourage anyone interested in pursuing an MBA to attend one of these events (they tour the whole world and are bound to come to a city near you). I myself was at a QS event in Frankfurt in 2006, which helped me decide for and against a couple of business schools. Basically, you have a hotel conference room where 20-30 business schools present their MBA programs, an ideal place to gather first-hand information and speak to admissions officers as well as current students or alumni.

If you have a good chat with someone, you can always reference this is in your motivational letters. Some schools also offer further research opps, such as IESE’s informative interviews. In my opinion a great way to learn more details about programs and the school and to get on the radar screen of the admissions team early on.

Finally, I also want to point out that the QS TOPMBA website is a great place to do some research business schools, learn about the admissions processes and funding possibilities as well as connect with other interested applicants. I used it myself during the preparatory phase before actually sending out applications.

With the new design, I also want to move away from the pure MBA-related content towards topics surrounding venture capital, startups and entrepreneurship. The simple reason is that I finished my studies more than one year ago and other topics have taken a more important place. Still, I will still have the occasional MBA-related post and am happy to answer any questions you might have. You will find all these posts under the category MBA.

Let me know what you think of the new theme?

BOW

BOW stands for Bar Of the Week and is a weekly event taking place every Thursday night. The BOW committee works relentlessly to find new and exciting Barcelona bars each week. On Thursday, usually around 11pm MBA students start arriving at the bar of the week where they get a special discount on drinks upon presenting their student card. Usually between 50 and 150 students can show up to this event and sometimes the occasional professor slips in. Nevertheless, the BOWs regularly take a toll which is impressively demonstrated by empty rows in the Friday morning sessions. This does create a bit of a problem since attendance is obligatory at IESE and a specific number of missed classes can be a reason for a “Fail”. So, you have to pick your BOWs wisely or be disciplined enough to leave the bars after an hour or two.

If you are a soon-to-be student looking for an apartment in Barcelona, here is an additional piece of information: 99% of the BOWs take place in Eixample. Check out my blog post on where to live if you need more info.

COW

The COW stands for Cow Of the Week and is a weekly event taking place after the last class session on Friday during which a “cow trophy” is handed over. The trophy and the exact process are usually organized by each section at the beginning of the MBA program. The COW event essentially consists of a student presenting a summary of the “most intelligent comments”, the “sharpest analyses” and whatever else caused classes to be interrupted by the laughter of 70 students.

At the end of the presentation a “winner” is chosen who receives the COW (see image above) and takes over the responsibility of recording potential COW comments throughout the next week as well as prepare the COW presentation for the following Friday. I had the questionable honor of presenting the COW twice during the first year and am also responsible for picking out this admittedly ugly stuffed cow trophy as I was the unfortunate first person to receive the comment of the week.

LOW

LOW stands for Lounge Of the Week and is a relatively new tradition that is held alive by second-year students. It is basically the same as a BOW, but takes place irregularly on Tuesday nights. Not too long ago, the IESE administration decided to clear most Tuesdays in the second year in order to provide a time window for the students to freely pursue any career-related activities. While many second-year students make use of this free time, some also take this as an opportunity to enjoy Barcelona on Tuesday night longer than usual. This is how the LOW was established and it has been quite successful thus far.

SPAM

Unlike the previous entries SPAM is not an abbreviation. It merely refers to spam, junk mail that annoys you and fills up your mailbox. At IESE it is a common practical joke to spam the whole school with embarrassing emails – with the small, but important distinction that the sender is never ever the author. Almost all of the fresh first-year students, exchange students and even “veteran” second-years have committed the ultimate sin and forgot to log off from a public university computer or leave their unlocked laptop unattended. It takes two minutes – and I am often surprised how creative people get within such short time frames – and a prankster will send out an embarrassing or annoying spam email from the unlocked mailbox to hundreds of accounts in the university community. This is childish, but usually it is funny as hell. My personal favorite spam mails are those that do not embarrass the forgetful person, but rather annoy him or her by creating even more spam. The last instance in this “category” I remember was a mail from an American exchange student who wrote that he had received a crate of several hundred iPhones from a friend at Apple for free. He proposed to sell them unlocked for $100.00 each to his fellow students. Apparently his mailbox was flooded at once since he had to send a follow-up email 10 minutes later clarifying that someone else had written the phony iPhone mail.

Dinners

Dinners play quite a big role in the social life of the IESE MBA experience. Dinners are organized on a frequent basis between smaller groups and larger groups. While small dinners usually involve students and sometimes professors spontaneously meeting at a restaurant or an apartment in the evening, the large dinners are thoroughly organized events. There is usually a section dinner (all students from one section) each term, one or two first-year dinners (all first-year students), one or two second-year dinners (all second-year students), a dinner where first- and second-year students mix and meet, team dinners (all students from a specific study group), exchange student dinners, ladies dinner (all female students from one section or class) and many more. Barcelona has fantastic restaurants and options are abundant.

Just to clarify: despite what the above might imply, IESE is by far not a party college! From my own experience while on exchange at another leading European business school, the descriptions of my fellow students who also went on exchange to one of the many other available exchange (business) schools, and based on the comments of exchange students who come to IESE, we truly work a LOT compared to other MBA programs! The IESE administration has a bit of a fixation on academics and the workload is absolutely intense. This is maybe the reason why students find outlets and make the most of the free time. In the end, it is up to each individual how to balance work and free time.

LSE AIC Flags

The second day of the conference did not start too well for me as I had to pull an all-nighter to finish a team project for my Venture Capital/Private Equity class. Since I did not want to go without any sleep, I closed my eyes for four hours and then headed over to the conference.

This was the second day of the private equity day of the conference and the LSE PE club had lined up some top speakers. Nevertheless, spirits were not higher than the day before. This makes sense if you take a look at some recent reports, such as “Get Ready for the Private Equity Shakeout” (pdf) by IESE‘s Heinrich Liechtenstein and BCG‘s Heino Meerkatt, in which the authors suggest that as many as 40% of global private equity firms might go out of business in the next couple years. Another report by publically listed private equity giant Candover explores the fact that the European PE transaction values have dropped by a whopping 59% compared to last year’s fourth quarter. I found the following sentence quite telling, given that Candover IS a large buy-out fund: “For the second time in the sample period and the first time since Q4 2007, no transactions were recorded at all in the largest value bracket, defined here as deals worth in excess of EUR 1.65bn.” One of the speakers at the LSE AIC summed up the overall sentiment quite well by telling his audience that “[...] right now it is about preserving value. If I return to my office after this speech and I find people being involved in sourcing transactions, I will fire them.”

Referring to my last post and my dresscode mishap, the following photo is a good example of how you should NOT dress at an alternative investments conference, when the dresscode is clearly stated as business standard.

However, as all MBAs learn schmoozing and networking is important and since I am interested in alternative investments, I decided to go – plus I had to pick up my CAIA charter (finally!) in London anyway. I have to say that LSE’s Private Equity Club really managed to draw a more knowledgeable crowd this year. I remember that last year top speakers were asked questions such as “What is the life of a consultant like?”, whereas participants this year seemed to have done their homework. I also met a lot of former fellow students from my exchange school LBS at the conference which was a pleasant surprise.

Moreover, I really liked the speakers and even got close to one of Germany’s economic heavyweights Josef Ackermann, the CEO of Deutsche Bank, who gave the second keynote speech. The first keynote was given by (in)famous Victor Haghani, one of the key figures of Long Term Capital Management (LTCM) – the hedge fund that almost brought down the financial system in 1998 when it collapsed. If you want to learn more about Victor and the extremely interesting story of LTCM, I recommend to you to read the book When Genius Failed: The Rise and Fall of Long-Term Capital Management.

I then attend some workshops focused on the topic of distressed strategies. I thought this might be the hot topic right now and the workshop was indeed oversubscribed. The first workshop was held by an executive VP of Sankaty Advisors, a debt focused hedge fund/affiliate of Bain Capital. I saw and liked the guy already last year, but he has gotten better. He pulled out some really insightful and entertaining slides, one of which showed that the value Citi alone has lost in the last year would be enough to purchase the equity – at current market prices – of all the remaining major investment banks. For those of you who are interested in getting into a fixed income fund, he mentioned a couple of points candidates should look out for when deciding to join a FI fund: a good fund should…

• focus on credit selection,…
• have solid experience in restructuring (apparently this means an unproportional number of lawyers),…
• possess strong trading capabilities,…
• have no redemptions,…
• and be structured so that the LP’s money is safely locked in.

While this sounds perfect in theory, I doubt that most applicants will have the luxury of being this picky. And I wonder which funds have not had redemption requests yet…

The next workshop was run by an MD (in the alternative investments group) from a well-know investment bank that had just been purchased by an American banking giant. Once again, very entertaining and informative workshop, although I found some of his remarks controversial. For instance, he used the allegory “You can’t blame drug pushers for pushing drugs, if there are drug buyers” referring to banks as the drug pushers and to hedge funds, endowments, etc. as drug buyers. But some of his points were less controversial and still quite interesting: when asked about the Ponzi scheme set up by Bernard Madoff, he mentioned that the biggest Ponzi scheme ever designed could actually be most of the world’s governments with their respective pension schemes and welfare systems based on fiat money.

Unfortunately, I had to leave after this workshop and head out to do some actual work for IESE classes. I am curious to attend the second day of the conference focusing on private equity. I registered for the workshop stream “Optimising Portfolio Companies”, a decision that was partially triggered by the research done by one of my professors, Heinrich Liechtenstein, who has written a couple of great papers on this topic in cooperation with other IESE professors and BCG’s private equity practice.

The only thing I regret is not having enough space in my suit case when I moved again from Germany to Spain. It is EXTREMELY embarrassing attending a conference where 300 people are dressed in black two- or three-piece suits when you are the only one dressed in jeans and a jacket. I stood out, but it made the networking part a lot harder.

More to follow soon…gotta go prepare some more cases for an IESE team project.

ieseblogs.com collects all possible blogs related to IESE Business School to give interested parties the possibility to sneak a peek inside the IESE world. Please tell people about this project, especially if they have a blog that is in some way related to IESE. Students, alumni, faculty and applicants are welcome to join.

Please leave me some feedback so I can improve the service. I am very curious to hear your opinion about this project.