Fitness Depot notifies customers of data breach

The fitness retailer has said its ISP was to blame for a breach of its online store

Person types on laptop in the dark

Fitness Depot notified its customers that their personal and financial information may have been stolen as part of an attack impacting the company's e-commerce platform.

The Canadian retailer was informed of the data breach on May 20, and recently sent a breach notification letter to all potentially impacted customers.

Per Fitness Depot’s letter, attackers compromised the company’s online store and gained access to customers’ personal and financial information. Information accessed by the attackers may have included customers' names, addresses, contact information and credit card numbers.

Based on the breach notification letter, all signs point to Fitness Depot having suffered from a Magecart attack. In these attacks, Magecart groups hack an e-commerce store’s checkout page and inject malicious JavaScript-based scripts that steal customer information entered into online payment forms. 

Though Fitness Depot discovered the breach on May 20, 2020, it dates as far back as Feb. 18, 2020. While customers who placed orders for home delivery were impacted between Feb. 18 and April 27, any customer who ordered products for home delivery or in-store pick-up would have been affected between April 28 and May 22.

"Once our customers where (sic) redirected to this form the customer information was copied without the authorization or knowledge of Fitness Depot," the company explained. "This is how the personal information was captured and stolen."

While Fitness Depot has stated "personal information was captured and stolen" during the breach, the company also shared it "has no knowledge that any of our customer information was compromised in any manner." Regardless, Fitness Depot has advised customers to protect themselves against identity fraud by monitoring their credit reports and reviewing account statements regularly.

Fitness Depot blames its internet service provider for the data breach, claiming it "neglected to activate the anti-virus software on our account." It’s unclear what Fitness Depot is referring to since it’s not typically an ISP’s job to equip its customers' e-commerce platforms with anti-virus software.

Featured Resources

Unlocking collaboration: Making software work better together

How to improve collaboration and agility with the right tech

Download now

Four steps to field service excellence

How to thrive in the experience economy

Download now

Six things a developer should know about Postgres

Why enterprises are choosing PostgreSQL

Download now

The path to CX excellence for B2B services

The four stages to thrive in the experience economy

Download now

Recommended

HackBoss malware is using Telegram to steal cryptocurrency from other hackers
cryptocurrencies

HackBoss malware is using Telegram to steal cryptocurrency from other hackers

16 Apr 2021
Russia launched over a million cyber attacks in three months
hacking

Russia launched over a million cyber attacks in three months

13 Apr 2021
Hackers leak data from dark web marketplace
cyber security

Hackers leak data from dark web marketplace

9 Apr 2021
Hackers are using fake messages to break into WhatsApp accounts
instant messaging (IM)

Hackers are using fake messages to break into WhatsApp accounts

8 Apr 2021

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021
Roadmap 2021: What’s coming from 3CX
Advertisement Feature

Roadmap 2021: What’s coming from 3CX

30 Mar 2021