Hundreds of people who use personal financial monitoring service Rudder woke up this morning to find that their personal bank account, credit card, and other financial data was exposed to other users. One Rudder user, Angie Seaman, told us that she received not only her own daily financial update from Rudder, but also the financial update for about 300 other users (see screen shot above). And not only could she see what was in their emails, but she could click through to their accounts. Seaman was understandably shocked and closed her account (see her full e-mail below). Plenty of other users have been complaining on Twitter as well.
I called up the company to find out what happened. Chief financial officer Nikunj Somaiya confirms that 732 accounts were compromised, or about 3.5 percent of active users. Members whose email start with the letters “a,” “b,” or a number had their account information shared before the company nticed and shut down all e-mail updates. Somaiya says, “We realize this is very sensitive information. We are extremely sorry.” But he also notes, “We get read-only access to balances and transaction. We don’t even store your banking user name and password. We can’t touch your money, nobody can move your money.” Yeah, but hundreds of Rudder members might now know how much other users have in their bank account.
This is another “walled-garden” solution – meaning the founders did all of the easy web 2.0 stuff – ajax, tagging, comments, etc. – but couldn’t make the hard choices when it came to site architecture and fell back on old web 1.0 ways of doing things. In this case, the easy decision was forcing people to write the content at the Minti site instead of aggregating it from the many blogs and other websties with content on parenting already out there on the web. 
