Fitness Depot notifies customers of data breach

The fitness retailer has said its ISP was to blame for a breach of its online store

Person types on laptop in the dark

Fitness Depot notified its customers that their personal and financial information may have been stolen as part of an attack impacting the company's e-commerce platform.

The Canadian retailer was informed of the data breach on May 20, and recently sent a breach notification letter to all potentially impacted customers.

Per Fitness Depot’s letter, attackers compromised the company’s online store and gained access to customers’ personal and financial information. Information accessed by the attackers may have included customers' names, addresses, contact information and credit card numbers.

Based on the breach notification letter, all signs point to Fitness Depot having suffered from a Magecart attack. In these attacks, Magecart groups hack an e-commerce store’s checkout page and inject malicious JavaScript-based scripts that steal customer information entered into online payment forms. 

Though Fitness Depot discovered the breach on May 20, 2020, it dates as far back as Feb. 18, 2020. While customers who placed orders for home delivery were impacted between Feb. 18 and April 27, any customer who ordered products for home delivery or in-store pick-up would have been affected between April 28 and May 22.

"Once our customers where (sic) redirected to this form the customer information was copied without the authorization or knowledge of Fitness Depot," the company explained. "This is how the personal information was captured and stolen."

While Fitness Depot has stated "personal information was captured and stolen" during the breach, the company also shared it "has no knowledge that any of our customer information was compromised in any manner." Regardless, Fitness Depot has advised customers to protect themselves against identity fraud by monitoring their credit reports and reviewing account statements regularly.

Fitness Depot blames its internet service provider for the data breach, claiming it "neglected to activate the anti-virus software on our account." It’s unclear what Fitness Depot is referring to since it’s not typically an ISP’s job to equip its customers' e-commerce platforms with anti-virus software.

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download

Recommended

Iranian hacking group continues to target US citizens
hacking

Iranian hacking group continues to target US citizens

18 Oct 2021
MirrorBlast phishing campaign targets financial companies
phishing

MirrorBlast phishing campaign targets financial companies

15 Oct 2021
Kaspersky exposes MysterySnail zero-day exploit in Windows
zero-day exploit

Kaspersky exposes MysterySnail zero-day exploit in Windows

13 Oct 2021
Supply chain breaches impacted 97% of firms in the past year
supply chain management (SCM)

Supply chain breaches impacted 97% of firms in the past year

12 Oct 2021

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
HPE wins networking contract with Birmingham 2022 Commonwealth Games
Network & Internet

HPE wins networking contract with Birmingham 2022 Commonwealth Games

15 Oct 2021
Veritas Backup Exec 21.3 review: Covers every angle
backup software

Veritas Backup Exec 21.3 review: Covers every angle

14 Oct 2021