  In the era of large-scale internet scanning, misconfigured websites are a
frequent cause of data leaks and security incidents. Previous research has
investigated sending automated email notifications to operators of insecure or
compromised websites, but has often met with limited success due to challenges
in address data quality, spam filtering, and operator distrust and disinterest.
While several studies have investigated the design and phrasing of notification
emails in a bid to increase their effectiveness, the use of other contact
channels has remained almost completely unexplored due to the required effort
and cost. In this paper, we investigate two methods to increase notification
success: the use of letters as an alternative delivery medium, and the
description of attack scenarios to incentivize remediation. We evaluate these
factors as part of a notification campaign utilizing manually-collected address
information from 1359 German website operators and focusing on unintentional
information leaks from web servers. We find that manually collected addresses
lead to large increases in delivery rates compared to previous work, and
letters were markedly more effective than emails, increasing remediation rates
by up to 25 percentage points. Counterintuitively, providing detailed
descriptions of possible attacks can actually *decrease* remediation rates,
highlighting the need for more research into how notifications are perceived by
recipients.
