Aptos malware breach affected 40 online retail stores
Aptos, Inc. provides e-commerce solutions for a number of online e-tailers. In November, 2016, Aptos discovered it had a malware breach from February, 2016 – December, 2016. At law enforcement’s request, they delayed notification to their clients, so we are first finding out about it now as the clients begin to disclose the breach to their customers.
So far, I’ve found notifications from the following:
AbbottStore.com was notified by Aptos on February 6. They report that the breach affected orders placed online between June 2013 – Dec 2016. Data types include: names, postal and email addresses, phone numbers, credit card numbers and expiration dates. For customers ordering between April 11 – August 18, 2016 and November 12 – November 28, 2016, cvv codes were also compromised. They provide no explanation as to why they were storing all that credit card data going back so far. Their site is currently not taking orders online, and they are offering customers 12 months of AllClear ID services.
LibertyHardware.com was notified by Aptos on February 7. For their customers, information entered before September, 2016 was involved: names, postal and email addresses, phone numbers, credit card numbers and expiration dates. They, too, are offering customers 12 months of AllClear ID services.
MrsPrindables.com was notified on February 6. As with other Aptos clients, data types include: names, postal and email addresses, phone numbers, credit card numbers and expiration dates. Customers who used their call center for orders were also affected. They are offering customers 12 months of credit monitoring services with Kroll. Of note, their notification to customers reports that
Aptos informed us that unauthorized person(s) electronically accessed and placed malware on Aptos’ platform holding information for 40 online retailers
so there are a lot more notifications to come, it seems. This post will be updated as more notifications are spotted.
Update 1. Add AffyTapple.com to the list.
Update 2. Add:
- BlueMercury.com, who reported 54,000 customers affected. BlueMercury had terminated their contract with Aptos in September, 2016 for unrelated reasons.
- Hue.com (Kayser-Roth Corporation)
- Purdys.com (13,500)
- WestMusic.com and PercussionSource.com
Update 3: Add:
Update 4: Add:
Update 5: Add:
Update 6: Add:
Update 7: Add:
Update 8: Add: