Fitness Depot notifies customers of data breach

The fitness retailer has said its ISP was to blame for a breach of its online store

Fitness Depot notified its customers that their personal and financial information may have been stolen as part of an attack impacting the company's e-commerce platform.

The Canadian retailer was informed of the data breach on May 20, and recently sent a breach notification letter to all potentially impacted customers.

Per Fitness Depot’s letter, attackers compromised the company’s online store and gained access to customers’ personal and financial information. Information accessed by the attackers may have included customers' names, addresses, contact information and credit card numbers.

Based on the breach notification letter, all signs point to Fitness Depot having suffered from a Magecart attack. In these attacks, Magecart groups hack an e-commerce store’s checkout page and inject malicious JavaScript-based scripts that steal customer information entered into online payment forms. 

Advertisement - Article continues below

Though Fitness Depot discovered the breach on May 20, 2020, it dates as far back as Feb. 18, 2020. While customers who placed orders for home delivery were impacted between Feb. 18 and April 27, any customer who ordered products for home delivery or in-store pick-up would have been affected between April 28 and May 22.

"Once our customers where (sic) redirected to this form the customer information was copied without the authorization or knowledge of Fitness Depot," the company explained. "This is how the personal information was captured and stolen."

Advertisement - Article continues below

While Fitness Depot has stated "personal information was captured and stolen" during the breach, the company also shared it "has no knowledge that any of our customer information was compromised in any manner." Regardless, Fitness Depot has advised customers to protect themselves against identity fraud by monitoring their credit reports and reviewing account statements regularly.

Fitness Depot blames its internet service provider for the data breach, claiming it "neglected to activate the anti-virus software on our account." It’s unclear what Fitness Depot is referring to since it’s not typically an ISP’s job to equip its customers' e-commerce platforms with anti-virus software.

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now


ethical hacking

Mobile banking apps are exposing user data to attackers

26 Jun 2020

Most malware came through HTTPS connections in Q1 2020

25 Jun 2020

Phishing attacks target unsuspecting Wells Fargo customers

24 Jun 2020

Trump administration wants to enhance the security of .gov sites

24 Jun 2020

Most Popular

Business operations

Nvidia overtakes Intel as most valuable US chipmaker

9 Jul 2020

How to find RAM speed, size and type

24 Jun 2020

Is it time to put Intel Outside?

10 Jul 2020