A new breach has been recorded in the state of Vermont, with customers of Simms, a fishing tackle sales company, being caught "in the nets" by cybercriminals.
Weston Fricke, the company's vice president of finance, says the breach was discovered earlier this month, on November 6, but the malware had been present in the online check-out system since September 1.
The threat has been removed but cybercriminals managed to gain access to names, addresses and credit card details, namely the card number, expiration date and CVV2 code (card verification value).
Online merchants do not store the CVV2 code in their systems, as it is not required by the Payment Card Industry Data Security Standard (PCI DSS), in order to reduce the risk of fraud.
This code is used in online purchases to confirm that the buyer actually has the card in their possession at the time of purchase. Without this number, cybercriminals will not be able to charge the card, even if they know the card number, expiration date, and owner's name.
In a letter addressed to users, Fricke says there is no indication that the stolen information has been misused.
The type of malware remains unknown at this time, but Simms assures that all threats have been removed from their systems by the website hosting.
However, the company is now partnering with an identity protection service and offering its customers a free one-year subscription. In the event of fraud, the service will cover financial losses, restore credit, and ensure that no damage is done to the customer's identity.
Despite the added protection, Simms still recommends that customers review their credit card on a regular basis and contact the protection service immediately if they notice unusual activity on their account.
