US retailer Hot Topic has revealed that two waves of credential stuffing attacks that took place in November 2023 may have led to a breach of data customer , while some payment details were also affected . The fast-fashion chain has over 630 stores in the US and Canada.
In credential stuffing attacks, attackers use automated tools to trigger millions of login attempts to accounts using combinations of usernames and passwords . This technique is particularly effective when users reuse login details across multiple platforms.
See also: Fujitsu: Detects malware in systems and breach of customer data
Hot Topic is sending letters to customers who may have been affected by the data breach. According to those letters, attackers targeted accounts Hot Topic Rewards in automated attacks, using login credentials obtained from an unknown source.
“We found that unauthorized parties launched automated attacks against our website and mobile app on November 18-19 and November 25, 2023, using valid credentials (e.g., email addresses and passwords) obtained from an unknown third-party source,” Hot Topic said in a statement.
Sensitive information that could have been exposed includes customer names, email addresses, order histories, phone, birth months and days, and mailing addresses.
See also: France Travail: Data breach affects 43 million people
Hot Topic says that the compromised Rewards accounts would have allowed attackers to access only some data , specifically the last four digits of the card number.
The company is working with external cybersecurity experts to create tools that will prevent such attacks.
Additionally, Hot Topic will require customers who receive data breach notifications to create a new password for their accounts and apps.
The breach of customers' personal data and banking information can lead to an increased likelihood of fraud, as attackers can use the stolen data to carry out illegal activities.
The situation also leads to a violation of customers' privacy , as their personal data can be leaked online and obtained by other cybercriminals .
See also: Stanford University: Data breach affects 27,000 people
Furthermore, these attacks can cause significant damage to Hot Topic's image and reputation, as customers may begin to doubt its ability to protect their personal data.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Source: www.bleepingcomputer.com
