A Jared customer found he could access other orders by changing a link in his confirmation email.
Major jewelry retailers Jared and Kay Jewelers have patched a website vulnerability that compromised order information for all online customers, Krebs on Security reported this week.
The bug was discovered and reported by a Jared customer who learned he could access other shoppers' orders by altering a link in his confirmation email and pasting the link into his browser. It was a small change, the report states, but it led him to orders containing peoples' names, billing and shipping addresses, phone numbers, email addresses, items and amount purchased, delivery date, tracking link, and the last four digits of the credit card used.
Recognizing the potential for criminals to abuse this data and concerned for the safety of his own, he reached out to Signet Jewelers, parent company of Jared and Kay Jewelers. Signet reports it fixed the problem for future orders; however, the shopper who found the problem claims the company didn't address data exposure for past orders until he reported it to Krebs.
Signet states the issue was limited to online orders for both Jared and Kay, and the websites of its other companies (Zales and Piercing Pagoda among them) were not affected.
Read more details here.
About the Author(s)
You May Also Like
The fuel in the new AI race: Data
April 23, 2024Securing Code in the Age of AI
April 24, 2024Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024