[Full-disclosure] Who should i contact?

[Joe Stewart]

On Wednesday 05 July 2006 04:09, screwedbytaxes at hushmail.com wrote:
> I've already asked the tax filing company for more information
> about any breaches they may have suffered and what other
> information may have been exposed. They asked for the source
> emails, which I provided, and I have not heard back. This was over
> a week ago.
>
> What should I do? What would you do?

Several Bagle variants have a function to collect email addresses from 
files on the infected system and upload them to the author for later 
spamming. This could be one potential vector for such a breach. 

However, before you go busting the filing company, are you sure that 
none of your own systems (which may have contained these addresses in 
an address book or a browser cache) were infected by Bagle at some 
point?

-Joe