Canada's Fitness Depot Alerts Customers to Data Breach

Fitness Depot, the largest retailer of specialty exercise equipment in Canada, has alerted customers to a data breach affecting its e-commerce platform. The incident dates back to February 2020 and may have affected some shoppers' personal and financial information.

In a letter to potentially affected customers, Fitness Depot says it was informed of an attack affecting transactions on May 22. The company shut down its service and launched an investigation that revealed criminals placed a fraudulent form on its website. When customers were redirected to the form, their information was captured. Customers with home delivery were affected between Feb. 18 and April 27. From April 28 through May 22, any shopper who ordered for home delivery or in-store pickup also could have been affected. 

Information collected by the attackers may have included customers' name, addresses, email addresses, phone numbers, and credit card numbers used in the transaction, Fitness Depot states. The breach has signs of a Magecart attack, a threat known for infecting e-commerce websites. 

In its letter, Fitness Depot blames its Internet service provider for the incident: "Based on our preliminary findings it appears our Internet Service Provider [ISP] neglected to activate the anti-virus software on our account," officials say. So far it's unclear what the company means by this, as the responsibility for installing antivirus software doesn't usually fall to the ISP.  

Read more details here.

Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register.