The Bulk Reef Supply (BRS) website was compromised in mid-2014, resulting in customer data being exposed to unauthorized third parties.
BRS is a retailer and manufacturer of marine aquarium supplies. Founded in 2007, the company was ranked 20th among the top fastest-growing private companies in the Minneapolis Metro Area last year (2014).
According to the official announcement, the website administrators became aware of an intrusion that lasted from July 30, 2014 to January 30, 2015.
The attackers were able to access customer information such as names and addresses, phone numbers, email addresses, and passwords. However, the financial information of some of the customers was also accessible to the attackers.
Immediately after discovering the incident on January 21, 2015, the company began an investigation led by experts and ended the breach the next day, although some corrective actions were also taken on January 30.
The delay in informing customers about the breach is due to the investigation, which was expected to reveal the exact individuals affected and the type of information exposed.
Bulk Reef Supply has notified the FBI about the incident and a cybersecurity firm has been contracted to perform security testing on a regular basis to reduce the risk of a future breach, the FAQ page for the incident states.
To protect its customers from any fraud attempts, BRS is offering one year of free subscription to an identity protection service for all affected users, regardless of whether financial information was exposed in their case or not.
In a letter to affected individuals, Bulk Reef Supply president Andrew Duneman offers details on how the identity protection service can be activated.
However, no evidence was found that the stolen data was misused in any way, but customers are urged to monitor their accounts for suspicious activity, and if they see signs of fraud, to call their bank or credit card company.
Additionally, all Bulk Reef Supply customers are required to change their log-in password and are advised to use a unique string that is not linked to any other online account.
