ZAGG Customers’ Credit Card Info Exposed in Third-Party Breach

December 30, 2024December 30, 2024

ZAGG Credit Card Data Breach: What You Need to Know

Utah-based consumer electronics accessories manufacturer ZAGG recently faced a significant data breach that compromised the credit card details of its customers. The breach occurred due to vulnerabilities in the FreshClicks app, a third-party application linked to the software-as-a-service (SaaS) e-commerce platform, BigCommerce. This incident highlights the importance of cybersecurity measures in today’s digital landscape.

According to reports from BleepingComputer, the malicious infiltration of FreshClicks allowed cybercriminals to deploy harmful code that extracted sensitive information, including names, addresses, and credit card details from ZAGG.com shoppers between October 26 and November 7. ZAGG has filed a breach notice with the Office of the Maine Attorney General, although the exact number of customers affected has not been disclosed.

Understanding the Impact of the ZAGG Breach

Compromised Data: Personal information, including credit card details, was at risk due to the breach.
Remediation Efforts: ZAGG has confirmed that it is actively addressing the situation and has offered complimentary credit monitoring services to affected individuals.
BigCommerce’s Response: BigCommerce has clarified that their internal systems were not compromised. They took immediate action to uninstall the FreshClicks app from ZAGG’s stores, which eliminated the compromised APIs and the malicious code used in this breach.

What Should Customers Do?

If you are a customer of ZAGG and shopped during the breach timeframe, here are steps you can take to protect yourself:

Monitor Your Accounts: Regularly check your bank statements and credit card activity for any unauthorized transactions.
Use Credit Monitoring Services: Take advantage of the complimentary credit monitoring offered by ZAGG.
Update Passwords: Change your passwords for accounts linked to your credit card to enhance security.

Conclusion

This incident serves as a critical reminder of the vulnerabilities that can arise from third-party applications in e-commerce. Staying vigilant and informed is essential for consumers in the digital age. For more information on how to protect yourself from data breaches, consider visiting resources like the Federal Trade Commission’s guide on protecting personal information.

We encourage readers to share their thoughts on this incident and explore related articles for further insights into data security and consumer protection.

Why Security Leaders Struggle to Secure Funding

FlowerStorm PhaaS Surges After Rockstar2FA Outage

December 23, 2024December 23, 2024

The FlowerStorm phishing-as-a-service platform poses a significant threat to Microsoft 365 credentials, especially following the recent decline of Rockstar2FA. A report from BleepingComputer indicates a surge in malicious activities targeting organizations in the U.S., Canada, the UK, Australia, and Italy. FlowerStorm primarily targets sectors like services, manufacturing, retail, and finance, utilizing similar HTML and credential-harvesting techniques as Rockstar2FA. Experts suggest potential links due to shared characteristics in their operations, though definitive connections remain unclear. Organizations are urged to bolster cybersecurity measures and educate employees on recognizing phishing attempts to safeguard their credentials.

Massive Phishing Scam Exploits Trust

December 12, 2024December 12, 2024

A sophisticated phishing campaign is targeting over 30 major organizations across various sectors, including government, finance, and telecommunications. Cybercriminals exploit trusted domains like Adobe.com to deceive employees into revealing sensitive information. Tactics used include fraudulent notifications and custom phishing pages that mimic legitimate websites. A report by Group-IB highlights the extensive reach of this campaign, indicating that no organization is safe. To combat these threats, organizations are advised to train employees, implement multi-factor authentication, and conduct regular security audits. Staying vigilant and proactive is essential to protect sensitive information and maintain operational integrity.

Atrium Health Breach Affects Over 585,000 Patients

Unsecured Database Exposes 3M Builder.ai Records

December 20, 2024December 20, 2024

Builder.ai, a UK-based AI startup, experienced a significant data breach exposing nearly 1.3 TB of sensitive data, including over 3 million records of personally identifiable information (PII) and operational details. The breach occurred due to an unsecured cloud database, which remained vulnerable for almost a month after being identified. This incident raises concerns about compliance with data protection regulations like the EU’s GDPR and the UK’s Data Protection Act. Experts emphasize the need for companies to prioritize data security through regular audits, strong access controls, and employee training to mitigate future risks.

STIIIZY Data Breach Exposes Customer Information

January 13, 2025January 13, 2025

A significant cyberattack has compromised customer data at STIIIZY, a major California marijuana dispensary, affecting locations in Alameda, Modesto, and San Francisco. The breach, linked to a third-party point-of-sale vendor, exposed sensitive information including names, ages, addresses, and identification numbers. The Everest ransomware group claimed responsibility, stating they stole over 422,000 records and threatened to leak the data if their demands are unmet. This incident underscores the urgent need for enhanced cybersecurity in the cannabis industry, prompting dispensaries to prioritize data protection as they grow. Consumers are urged to stay informed and safeguard their personal information.

American Addiction Centers Hack Affects Over 422,000

December 27, 2024December 27, 2024

American Addiction Centers, a Tennessee-based substance abuse treatment provider, experienced a major data breach affecting over 422,000 individuals. The breach, linked to the Rhysida ransomware operation, resulted in the theft of sensitive information, including names, birthdates, Social Security numbers, and medical records, although payment card data remains secure. Much of the stolen data has already been leaked online. Affected individuals may face increased risks of identity theft, prompting recommendations to monitor financial accounts, check credit reports, and consider identity theft protection services. This incident highlights significant vulnerabilities in healthcare data security.

Nebraska Lawsuit Filed Over Change Healthcare Breach

December 19, 2024December 19, 2024

Change Healthcare is facing a lawsuit from Nebraska Attorney General Mike Hilgers for alleged negligent cybersecurity practices following a cyberattack that compromised personal data of nearly 100 million Americans. The attack disrupted healthcare services, delayed patient care, and increased risks of fraud, particularly affecting rural hospitals financially. Change Healthcare’s parent company, UnitedHealth Group, plans to contest the lawsuit, claiming it lacks merit. This situation highlights the urgent need for improved cybersecurity measures in healthcare, as the industry increasingly relies on digital systems. The outcome of the lawsuit may influence future cybersecurity regulations within the sector.