Canada's Fitness Depot Alerts Customers to Data BreachCanada's Fitness Depot Alerts Customers to Data Breach
The retailer reports cybercriminals infected its online store and used a fraudulent form to steal shoppers' information.
June 9, 2020
Fitness Depot, the largest retailer of specialty exercise equipment in Canada, has alerted customers to a data breach affecting its e-commerce platform. The incident dates back to February 2020 and may have affected some shoppers' personal and financial information.
In a letter to potentially affected customers, Fitness Depot says it was informed of an attack affecting transactions on May 22. The company shut down its service and launched an investigation that revealed criminals placed a fraudulent form on its website. When customers were redirected to the form, their information was captured. Customers with home delivery were affected between Feb. 18 and April 27. From April 28 through May 22, any shopper who ordered for home delivery or in-store pickup also could have been affected.
Information collected by the attackers may have included customers' name, addresses, email addresses, phone numbers, and credit card numbers used in the transaction, Fitness Depot states. The breach has signs of a Magecart attack, a threat known for infecting e-commerce websites.
In its letter, Fitness Depot blames its Internet service provider for the incident: "Based on our preliminary findings it appears our Internet Service Provider [ISP] neglected to activate the anti-virus software on our account," officials say. So far it's unclear what the company means by this, as the responsibility for installing antivirus software doesn't usually fall to the ISP.
Read more details here.
Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really bad day" in cybersecurity. Click for more information and to register.
About the Author(s)
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023