If you live in the U.S. or Canada and purchased an Acer device from
the company within the last year from its online store, then your credit
card information is likely in the hands of cyber thugs.
According to a sample breach notification letter sent to the California Attorney General’s office, Acer said, “We recently identified a security issue involving the information of certain customers who used our ecommerce site between May 12, 2015 and April 28, 2016, which resulted in unauthorized access by a third party.”
Mark Groveunder, Acer’s vice president of customer service, warned
affected customers that the data stolen included names, addresses,
credit card numbers as well the associated expiration date and
three-digit CVV security code.
The Taiwanese company said 34,000 customers across the U.S., Canada and Puerto Rico were affected.
The company hired “outside cybersecurity experts” to investigate the breach, but at this time it does believe password or login credentials were stolen.
Softpedia noted that Acer runs its store on the Magento Enterprise platform, but the security issue came from one of its third-party payment processing systems. The company “took steps to remediate the issue, and later notified the credit card payment processor.” It also offered to fully cooperate with federal law enforcement.
Hacking a company via a third party is nothing new. Javvad Malik, security advocate at AlienVault, told IBTimes, “Attackers will choose the path of least resistance to get into a company—and if it is well-secured, then this path will usually be through a third party that has legitimate access. Having an appropriate supplier security assurance framework in place that sets the requirements for a third party and also the ongoing controls is essential.”
Acer is not offering free credit monitoring or identity protection services, but it advised affected customers of their right to file a police report, contact their State Attorney General’s office or the Federal Trade Commission.
The letter also contained a “resource guide” about how to place a fraud alert for identity theft or a security freeze on credit files.
According to a sample breach notification letter sent to the California Attorney General’s office, Acer said, “We recently identified a security issue involving the information of certain customers who used our ecommerce site between May 12, 2015 and April 28, 2016, which resulted in unauthorized access by a third party.”
The Taiwanese company said 34,000 customers across the U.S., Canada and Puerto Rico were affected.
The company hired “outside cybersecurity experts” to investigate the breach, but at this time it does believe password or login credentials were stolen.
Softpedia noted that Acer runs its store on the Magento Enterprise platform, but the security issue came from one of its third-party payment processing systems. The company “took steps to remediate the issue, and later notified the credit card payment processor.” It also offered to fully cooperate with federal law enforcement.
Hacking a company via a third party is nothing new. Javvad Malik, security advocate at AlienVault, told IBTimes, “Attackers will choose the path of least resistance to get into a company—and if it is well-secured, then this path will usually be through a third party that has legitimate access. Having an appropriate supplier security assurance framework in place that sets the requirements for a third party and also the ongoing controls is essential.”
Acer is not offering free credit monitoring or identity protection services, but it advised affected customers of their right to file a police report, contact their State Attorney General’s office or the Federal Trade Commission.
The letter also contained a “resource guide” about how to place a fraud alert for identity theft or a security freeze on credit files.
Комментариев нет:
Отправить комментарий