At around 1 a.m. PST, we learned that a security researcher in Russia discovered that the tools we were using to process unsubscribe requests could be compromised to expose the email addresses of other people who also received the same newsletter. We fixed the problem as soon as we were notified about the flaw, but there was a roughly 12 hour period when email addresses could have been retrieved.

There is no evidence of a large-scale compromise, but an analysis of our log files during the affected time period shows that up to 536,613 email address of people who received our last Russian-language newsletter and up to 72,406 email addresses of people who received our English-language newsletters may have been seen by an unauthorized third party. Possession of an email address is not enough to compromise an Evernote account or access other private information, so you can be assured that all of the data in your Evernote account is safe and cannot be accessed by anyone other than you. However, it is possible that some of the exposed email addresses may have landed in the hands of spammers.

We take security and privacy very seriously at Evernote which is why, even though there was no apparent breach of account data in this incident, we think it’s important to describe the details of the situation. We apologize for this mistake and hope that it does not burden our users with extra spam. As always, please be careful about responding to email communications from people claiming to be employees of Evernote. In particular, remember that no Evernote employee will ever ask you for your password, credit card number, or other personal information.

If you have any additional questions or concerns, please contact Evernote Support.

Evernote has developed applications and plug-ins for over a dozen different platforms, and those clients have uploaded more than 1.3 billion notes and files to our service. As a result, our technology folks have learned a lot of lessons that could be helpful to other engineers, sysadmins, and researchers. We’re going to start sharing some technical internals, anecdotes and geeky tidbits on our new Tech Blog.

These posts should be helpful to other technologists, and they may also be interesting to some of our more tech-savvy users.

Take a look at the overview of Evernote’s service architecture post.

When you add a note to the service, it is secured like your email would be at a high-end email provider. This means that your notes are stored in a private, locked cage at a guarded data center that can only be accessed by a small number of Evernote operations personnel. Administrative maintenance on these servers can only be performed through secure, encrypted communications by the same set of people. All network access to these servers is similarly protected by a set of firewalls and hardened servers. Your data is only transmitted to the servers in encrypted form over SSL, and your passwords are not directly stored on any of our systems.

We also offer enhanced privacy options that would not be available from services like email:

If you have sensitive text that you would like to remember (passwords, PINs, credit card numbers), you can encrypt that text in our Windows and Mac clients using a passphrase that is never transmitted to Evernote. This encrypted text can only be decrypted and read on one of your computers after you’ve re-entered the encryption passphrase. The sensitive text is not readable on our servers or on your computer by anyone who does not know the passphrase.

If you have some notes that you only want to access from a single computer, you can place these into a “Local Notebook” on our Windows or Mac client. Notes in a Local Notebook are never transmitted to our service, so they aren’t accessible from the web, or from your other computers. This may allow a greater level of privacy for some notes, at the expense of the accessibility and reliability you would get from a private note on the service.

Evernote recognizes that user choice is an important component of privacy and security. We believe that no single option is going to meet the needs of all users, so we aim to offer a set of tools that let people balance their needs for accessibility, privacy and control.

Update: How to encrypt and decrypt text in Evernote