Subject: Crazy “New York Times” Email Tells People They’ve Cancelled Their Print Subs, Isn’t Actually From The NYT | TechCrunch
From: "Eric Schwerin" <[email-masked]>
To: "Hunter Biden" <[email-masked]>, "Joan Peugh" <[email-masked]>, "Anne Marie Person" <[email-masked]>
Date: Wed, 28 Dec 2011 14:47:12 -0500

http://techcrunch.com/2011/12/28/crazy-new-york-times-email-tells-people-theyve-cancelled-their-print-subs-isnt-actually-from-the-nyt/

Crazy “New York Times” Email Tells People They’ve Cancelled Their Print Subs, Isn’t Actually From The NYT

If you’re a New York Times subscriber — or even if you’re not — you may have received that following email this morning, implying that you have cancelled your subscription. Many many people did, it’s all over the tweets. 

Even though the email was sent from an address that had sent out legitimate emails in the past, “email.newyorktimes.com,” it wasn’t actually from the New York Times, as some of their more tech hipster reporters and their official Twitter account confirmed, “If you received an email today about canceling your NYT subscription, ignore it. It’s not from us.”

Here is the email in question:

Dear Home Delivery Subscriber,

Our records indicate that you recently requested to cancel your home delivery subscription. Please keep in mind when your delivery service ends, you will no longer have unlimited access to NYTimes.com and our NYTimes apps.

We do hope you’ll reconsider.

As a valued Times reader we invite you to continue your current subscription at an exclusive rate of 50% off for 16 weeks. This is a limited-time offer and will no longer be valid once your current subscription ends.*

Continue your subscription and you’ll keep your free, unlimited digital access, a benefit available only for our home delivery subscribers. You’ll receive unlimited access to NYTimes.com on any device, full access to our smartphone and iPad® apps, plus you can now share your unlimited access with a family member.†

To continue your subscription call 1-877-698-0025 and mention code 38H9H (Monday–Friday, 8:30 a.m. to 8:30 p.m.; Saturday, 9 a.m. to 3 p.m. E.D.T.).

So what happened? Most likely a case of email header spoofing.  Those with the wrong motivations can tweak the “from” field in an e-mail pretty easily. So what’s the NYT IT department doing right now? Probably tracking down the “spoof” e-mail IP –

Some users are independently reporting that the spoof IP belongs to Epsilon, an email firm that was hacked last spring. It’s also possible that Epsilon done goofed and did something silly like hit “reply all.”

In any case, it’s made for some interesting Twitter hilarity.

Eric D. Schwerin
Rosemont Seneca Partners, LLC
1010 Wisconsin Ave., NW
Suite 705
Washington, DC 20007
(202) 333-1880
[email-masked]
P Consider the environment before printing this email.