Graduates from various universities in the USA reported fraudulent transactions after using their payment cards at Herff Jones, a company that sells graduation items.
See also: MangaDex reveals it suffered a data breach
After the reports that started last Sunday, the company launched an investigation to determine the extent of the data breach.
The complaints continued this week, warning others to check their credit card statements for unauthorized charges. The issue affects students across the U.S. at universities in Indiana (Purdue, IU), Boston, Maryland (Towson University), Houston (UH, UHD), Illinois, Delaware, Michigan, Wisconsin, Pennsylvania (Lehigh, Misericordia), New York (Cornell), Arizona, North Carolina (Wake Forest), Florida (State University), and California (Sonoma State).
See also: Data breach at popular marketplace Reverb
The company Herff Jones was unaware of the breach until the students began protesting on social media about the fraudulent charges on their payment cards.
The common denominator is that they are graduates who had purchased products from Herff Jones. Some of them had to cancel their payment cards and contact the bank to report the fraudulent charges.
In addition to delivery delays, students complained about fraudulent charges ranging from a few dollars to thousands. While most reports cite losses between $80 and $1,200, one student said a friend of his was charged $4,000.
A senior at Cornell University said he had to cancel his credit card because scammers tried to make $3,000 in purchases and also used it on the adult content subscription service OnlyFans.
It is not clear when the breach at Herff Jones occurred, but some of the earliest transactions date back to the beginning of the month. Many students said they bought graduation items in April.
See also: Dating app Manhunt suffers serious data breach
On May 12, Herff Jones released a statement acknowledging the breach of payment card data and apologized for the incident. The company is investigating the incident with the help of a «top cybersecurity company».
Information source: bleepingcomputer.com
