794,000 Kiddicare customer details stolen in data breach

Personal details, including names, addresses and telephone numbers, stolen from test website

Parenting retailer Kiddicare has revealed up to 794,000 of its customers have been the subject of a data breach after a testing website was hacked.

The company was made aware of the breach after customers reported suspicious text messages sent to them that did not appear to be from Kiddicare.

An initial internal investigation suggested there had been no breach of its systems, however a security company later informed Kiddicare was a test site in use since 2015 that had been breached, rather than any of its live systems. Further internal investigations confirmed this was the case and that the names, addresses and telephone numbers of real customers had been stolen.

Independent security researcher Graham Cluley said in a blog post: "In principal, there's nothing really wrong with using real production data on a test environment *if* the test site is properly secured and does not make it easier for hackers to steal information than, say, on the normal, live servers. But it shouldn't be forgotten that this was a test site, and things are expected to go wrong.

"Unfortunately, time and time again it's seen that companies can be sloppier about the security of their test sites than their official sites opening opportunities for data thieves and hackers. For that reason it's usually much safer to generate fake data for testing purposes just in case."

Payment information such as credit card and bank details were not included in the breached database, meaning money could not be stolen from customers using the information extracted in the hack. However, criminals could use the data they do have in phishing scams designed to trick targets into handing over financial details.

"We are very sorry for the potential stress and anxiety this incident may have caused our customers," Kiddicare said in a statement.

"We want to reassure everyone that the problem has been fixed, increased security measures have been implemented and we have a dedicated team to here to help with any further concerns."

As a result of the breach, Kiddicare has reported itself to the Information Commissioner's Office (ICO), which will investigate further into how the breach happened.

"This latest breach goes to show how important it is to continually monitor for anomalous activity across the entire breadth of the network," Justin Harvey, CSO at Fidelis Cybersecurity said.

"While it's admirable that Kiddicare has gone straight to the UK's Information Commissioner, it's not good enough that the breach was discovered by customers whose information had not only been lost but already used with bad intentions."

"Once again it's the customers who are feeling the effects of a company's carelessness," Trent Telford, CEO at Covata added. "When websites are in the midst of development things are bound to go wrong, but this latest breach begs the questions why real customer data was used and, critically, why it wasn't encrypted."

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Recommended

Global ransom DDoS extortionists are retargeting companies
distributed denial of service (DDOS)

Global ransom DDoS extortionists are retargeting companies

22 Jan 2021
BEC scammers are using Google Forms to identify easy victims
phishing

BEC scammers are using Google Forms to identify easy victims

21 Jan 2021
FBI warns of ongoing corporate vishing attacks
phishing

FBI warns of ongoing corporate vishing attacks

19 Jan 2021
Hackers using COVID vaccine as a lure to spread malware
hacking

Hackers using COVID vaccine as a lure to spread malware

15 Jan 2021

Most Popular

How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

21 Jan 2021
What is the Raspberry Pi Pico?
Hardware

What is the Raspberry Pi Pico?

21 Jan 2021
WhatsApp could face €50 million GDPR fine
General Data Protection Regulation (GDPR)

WhatsApp could face €50 million GDPR fine

25 Jan 2021