Hundreds of people who use personal financial monitoring service Rudder woke up this morning to find that their personal bank account, credit card, and other financial data was exposed to other users. One Rudder user, Angie Seaman, told us that she received not only her own daily financial update from Rudder, but also the financial update for about 300 other users (see screen shot above). And not only could she see what was in their emails, but she could click through to their accounts. Seaman was understandably shocked and closed her account (see her full e-mail below). Plenty of other users have been complaining on Twitter as well.

I called up the company to find out what happened. Chief financial officer Nikunj Somaiya confirms that 732 accounts were compromised, or about 3.5 percent of active users. Members whose email start with the letters “a,” “b,” or a number had their account information shared before the company noticed and shut down all e-mail updates. Somaiya says, “We realize this is very sensitive information. We are extremely sorry.” But he also notes, “We get read-only access to balances and transaction. We don’t even store your banking user name and password. We can’t touch your money, nobody can move your money.” Yeah, but hundreds of Rudder members might now know how much other users have in their bank accounts.

It could have been worse. Rudder only lets members keep track of their financial accounts and balances in one place. It doesn’t allow people to access the underlying accounts. It doesn’t show passwords or social security numbers or even real names—unless, of course, you use your real name as your email address, which many people do.

So how did this happen? Rudder’s emails were getting caught up as spam by Yahoo, so all of its users with Yahoo Mail accounts weren’t getting any updates. After talking with Yahoo, Rudder added a new DomainKeys Identified Mail (DKMI) component to its outgoing emails last night which adds a signature to each email that verifies it is coming from a valid domain. But for some reason, “instead of separating the emails, it appended them together,” explains Somaiya. So those 732 users received not only their own financial updates, but also all of the updates from the appended accounts.

Somaiya says Rudder is bringing in a security consultant to go over their procedures and will implement any and all suggestions. But it might be too late. When it comes to personal finance, trust is everything, even if it is just your financial data you are entrusting to a site and not actual transactional capabilities. Will Rudder be able to bounce back from this breach? And will competitors such as Mint also be tarnished with doubt, or will they be able to capitalize on Rudder’s misstep?

Here is Angie Seaman’s email to us:

I’m not sure if you’ve heard this one yet, but this morning I woke up to a really unpleasant surprise. I had several hundred email updates from Rudder, only one was actually intended to be delivered to me.

The rest were to other users. Yes, I got about 300 users’ daily financial update information. I think I would have gotten more had I not deleted my account when it started happening. I got mostly email addresses that started with “a” and “b.” That’s shocking enough. I cancelled my account right away, but then wondered–can these people access my account?

So I clicked on one of the emails I received and lo and behold, it logged me right in as them. Obviously I didn’t do anything with their account but I could have.

There isn’t address information or full account numbers, but it’s pretty unreal that I was able to just access about 300 other users’ personal banking details. I don’t think they wanted me to know they’ll have like $1.83 left at the end of the month and I don’t really want them to know my info.

Update: As a precautionary measure, the company will be offering a free identity-theft service to all compromised Rudder members.

Crunch Network: CrunchBase the free database of technology companies, people, and investors

As Michael Arrington wrote his initial review of the site in March 2006, the overall concept of Minti isn’t entirely new. As a service it sits somewhere between an advice site such as BabyCentre (a site I visited regularly when I was on the road to parenthood) and a forum. The difference is in the implementation.

Weighing User Generated Interactions

Minti is powered by the Vibe Engine, a custom built CMS owned by Vibe Capital (the majority shareholders of Minti) that also powers sites such as Refurber.

Minti has over 20,000 active registered members (as opposed to inactive or casual visitors, they are doing 7 figures in traffic) who comment, vote, tag, and contribute advice. Consider something like Breastfeeding; Minti has many user generated advice articles on the subject but it’s how they are weighed that makes the service usable and perhaps something different.

The Vibe Engine weighs votes on an article based on a number of factors. Anyone can vote, but an unregistered visitor’s vote is not weighed as heavily as a registered user. Users themselves fall into ten member categories based on the amount of activity the undertake on Minti itself. Each level has a higher weighing meaning that users who are more active have a stronger vote than those who aren’t. It should be noted that none of this is evident to the user; these are all primarily backend levels, although at certain levels users get extra privileges including the ability to mark a contribution for review/ deletion is it is not of a reasonable standard. Users at higher levels also get to vote on reviews/ deletions as well in a truly distributed management model where regular users have ownership in decision making.

Overall the model delivers user rated results that serve to filter lots of information in a more accessible fashion for all readers.

Because They Care

I can at times be a little skeptical towards sites that tap into user generated content to build a destination, particularly when those sites then go on to profit greatly from those contributions; the build it, exploit it, flip it mentality is very much alive in Web 2.0. What impressed me about Rachel and Clay Cook (Minti’s founders) was that in building Minti they built something they would use themselves, and more importantly could help others as well. As parents of young children (about the same age as my son) they’d used the net to find info in much the same way I have previously, and shared the same frustrations; generally when you’re seeking information on a parenting topic you like more than one opinion, and yet many services often only provide a limited number of views. With Minti they are aiming to provide a wealth of first hand knowledge and advice, a one stop shop for all things parenting that isn’t as perhaps lecturing as some advice you find online elsewhere.

What perhaps they didn’t see happening (to the extent that it has) is the social networking aspect of Minti. I heard some amazing stories of complete strangers who knew each other only via Minti helping each other in times of crisis, not just online but taking their online relationship’s offline as well. For privacy considerations I can’t print the stories, but they were something that I’ve not heard from a startup before. Minti has become a community focused site very much in the traditional sense of the word community, complete with relationships and friendly advice. In an age where we spend more and more time online, whilst conversely spending less and less time offline building face to face relationships, Minti provides a place where parents can connect, in effect recreating the community spirit of old.

Would You Use It?

The biggest test for any site is in using it. Obviously this is a site focused on parents so it won’t appeal to everyone. I like the ability to get different opinions quickly and easily, filtered and rated for your consideration. The inclusion of comments at the base of articles brings in one of the best features of blogs so that immediately you get a sense of how others view the advice as well. Related articles and external links means that users can easily access more information on the topic, and tagging is surprisingly done well on the site. If I were going down the path of having another child (well, I’m important initially in that process..perhaps not so much after), I’d jump straight into Minti. Now if only they had a working cure for my wife’s seriously terrible disposition in the first trimester I’d be calling for the Nobel Prize to be awarded.

Minti’s competitors include Maya’s Mom (acquired by BabyCentre for $7m) and Mothers Click.

Crunch Network: CrunchBoard because it’s time for you to find a new Job2.0

On Refurber, users are able to share advice on a wide range of home improvement related topics. Content throughout the site is user generated with articles being tagged, rated and commented on by the greater community to encourage integrity and relevancy in the information created.

It’s a decent resource if DIY is your thing and the layout is well thought out and accessible.

The backend is the same as Minti; the “vibEngine” API powers both sites. The vibEngine platform is being licensed to other vertical sites in a move that sees Vibe evolve from site creator to solutions provide. The first licensed partner of vibEngine is the niche city focused site BuildingInLondon.com with further sites running vibEngine launching in the coming months.

Crunch Network: CrunchGear drool over the sexiest new gadgets and hardware.

There are good reasons not to mention Minti and push traffic to it – it’s actually not doing anything feature wise that’s new and it’s another walled garden of content.

But I am going to mention it because it is well designed and built and has good features. It also may be useful to people who have or are planning to have children. Also, I like to see niche content sites spring up that use web 2.0 ideas – these services will help the masses start to use and understand things like tagging, ajax, etc.

And writing about Minti also gives me an opportunity to talk about user generated data and who exactly owns it.

This is another “walled-garden” solution – meaning the founders did all of the easy web 2.0 stuff – ajax, tagging, comments, etc. – but couldn’t make the hard choices when it came to site architecture and fell back on old web 1.0 ways of doing things. In this case, the easy decision was forcing people to write the content at the Minti site instead of aggregating it from the many blogs and other websties with content on parenting already out there on the web.

And you have to read the content on the Minti, too. No RSS feeds.

Visitors can also read all of the reviews written by a particular user. This is a good start because they’ve effectively set up a blog-like area for each user where all of their articles on parenting are aggregated (and have the nice Minti search engine attached to the blog). But again, without an RSS feed and the ability to syndicate out the content, Minti is telling its users that Minti owns the content that they write, not them.

Bottom line – this isn’t revolutionary and if you aren’t a parent you won’t find anything useful there to inspire you. But Minti could be a good resource for parents and maybe they’ll add the better ways to get data into and out of the service over time. Minti, if you are listening, I’d be happy to enter into a discussion with you on how I think you could accomplish that.

Minti is based in Australia and launched on March 8, 2006. They have raised A$1.6 million in seed financing.