Potential Eventbrite Data Breach

[SebDaniels]

Hi all, 

There is a potential data breach when using the Eventbrite integrated app from the HubSpot Market place. 

I have one Eventbrite account - lets call it User#1.

We work for multiple clients that use Eventbrite - let's call them Organisation#1, Organisation#2 and Organisation#3.

Organisation#1, Organisation#2 and Organisation#3 all add my User#1 to their teams so that I can access all their accounts easily. 

HOWEVER -  this means that any Eventbrite-HubSpot integration that is connected via User#1's account, will show event data from Organisation#1, Organisation#2 and Organisation#3.

And if "Automatically sync new events" is ticked, all new events and contacts will be imported into Organisation#1, Organisation#2 and Organisation#3 HubSpot instances.

- - - 

Hope that makes sense. 

Please comment with any questions below.

Thanks, 

Seb

[Jnix284]

@SebDaniels looking at the getting started guide, it looks like you have to configure the integration in each portal, and clearly states how to handle multiple organizations:

• If your Eventbrite account has access to multiple organizations, you can switch between them to view events created for a different organization. Click the dropdown menu under Choose an organization to see their events, then select a different organization.

Have you already done this and it is still not working properly?

[SebDaniels]

Hiya, I think you've missed the point of my post:

if you use the same login to connect Eventbrite to HubSpot for Organisation#1, Organisation#2, and Organisation#3 in each of their HubSpot instances, then ALL three will have access to all the organisations connected to the users account i.e. Organisation#3 will be able to see all of Organisation#1's events.

[Jnix284]

Hi @SebDaniels  ah, I see, it's the visibility that is having an impact, but as the "User#1" aren't you the only one who can see all of the events, or can other users in each account see and modify the integration settings?

If so, my question would be, is there another user that is also an admin on each individual Eventbrite account that could be used to connect the app integration, instead of yours that has access to all 3?

[SebDaniels]

@Jnix284 so in Eventbrite, yes I'm the only person that can see each different organisation's events.

But in HubSpot, under the "Choose an organization to see their events" drop down, all the organisations I'm connected too will show up. And if "Automatically sync new events" is ticked, new events from all organisations are added AND the contacts are automatically added to HB. 

[SebDaniels]

And yeah, your solution is the correct solution - use different email addresses for each Eventbrite instance and then connect each one to each HubSpot instance.

However, doing this removes the nice Eventbrite one account to access multiple organisations' functionality and creates another potential data breach, as you need to know login details for lots of different accounts and they need to be shared with you. 

[Jnix284]

@SebDaniels agree that it is not ideal to have to create separate accounts for each organization - my suggestion wasn't for you to have multiple, but to have a second person at each organization.

For example:

USER#1 - Eventbrite Owner with access to org#1, org#2, org#3

USER#2 - added to eventbrite as an Admin, access to org#1 only

USER#3 - added to eventbrite as an Admin, access to org#2 only

USER#4 - added to eventbrite as an Admin, access to org#3 only

And then, in HubSpot, instead of having User#1 setup the app integration with Eventbrite, have User#2 set up for Org#1 so only Org#1 data pulls in, etc.

[SebDaniels]

Yeah that's a nice work around too.

As you've commented below, it would be good to flag it with Eventbrite.

In an ideal world, I think the best solution would be to have a HubSpot style gateway (like https://app.hubspot.com/myaccounts-beta). So when you connect to Eventbrite through the ingtergtaton, you have to choose which organisation you want to connect HB to.

[Jnix284]

@SebDaniels I would definitely let them know about the issue, and your idea. The app marketplace has the support info if you want to try calling directly (the link just goes to the HubSpot website/support, which I imagine you could also use):

[Jnix284]

@SebDaniels understood, it's unclear from the documentation what the expected behavior for the "Automatically sync new events" checkbox is - whether that means all organizations, or only the one you are viewing in the dropdown.

@Jaycee_Lewis any insight on how to submit a bug report for the Eventbrite app integration, it is one that is provided by HubSpot?