The retailer reports cybercriminals infected its online store and used a fraudulent form to steal shoppers' information.

Dark Reading Staff, Dark Reading

June 9, 2020

1 Min Read

Fitness Depot, the largest retailer of specialty exercise equipment in Canada, has alerted customers to a data breach affecting its e-commerce platform. The incident dates back to February 2020 and may have affected some shoppers' personal and financial information.

In a letter to potentially affected customers, Fitness Depot says it was informed of an attack affecting transactions on May 22. The company shut down its service and launched an investigation that revealed criminals placed a fraudulent form on its website. When customers were redirected to the form, their information was captured. Customers with home delivery were affected between Feb. 18 and April 27. From April 28 through May 22, any shopper who ordered for home delivery or in-store pickup also could have been affected. 

Information collected by the attackers may have included customers' name, addresses, email addresses, phone numbers, and credit card numbers used in the transaction, Fitness Depot states. The breach has signs of a Magecart attack, a threat known for infecting e-commerce websites. 

In its letter, Fitness Depot blames its Internet service provider for the incident: "Based on our preliminary findings it appears our Internet Service Provider [ISP] neglected to activate the anti-virus software on our account," officials say. So far it's unclear what the company means by this, as the responsibility for installing antivirus software doesn't usually fall to the ISP.  

Read more details here.

VIRTUALSUMMIT_DR20_320x50.jpg

 

 

 

 

 

 

Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights