Aptos malware breach affected 40 online retail stores

Aptos, Inc.  provides e-commerce solutions for a number of online e-tailers. In November, 2016, Aptos discovered it had a malware breach from February, 2016 – December, 2016.  At law enforcement’s request, they delayed notification to their clients, so we are first finding out about it now as the clients begin to disclose the breach to their customers.

So far, I’ve found notifications from the following:

AbbottStore.com was notified by Aptos on February 6. They report that the breach affected orders placed online between June 2013 – Dec 2016. Data types include: names, postal and email addresses, phone numbers, credit card numbers and expiration dates. For customers ordering between April 11 – August 18, 2016 and November 12 – November 28, 2016, cvv codes were also compromised. They provide no explanation as to why they were storing all that credit card data going back so far. Their site is currently not taking orders online, and they are offering customers 12 months of AllClear ID services.

LibertyHardware.com was notified by Aptos on February 7. For their customers, information entered before September, 2016 was involved: names, postal and email addresses, phone numbers, credit card numbers and expiration dates. They, too, are offering customers 12 months of AllClear ID services.

MrsPrindables.com was notified on February 6. As with other Aptos clients, data types include: names, postal and email addresses, phone numbers, credit card numbers and expiration dates. Customers who used their call center for orders were also affected. They are offering customers 12 months of credit monitoring services with Kroll.  Of note, their notification to customers reports that

Aptos informed us that unauthorized person(s) electronically accessed and placed malware on Aptos’ platform holding information for 40 online retailers

so there are a lot more notifications to come, it seems.  This post will be updated as more notifications are spotted.

Update 1. Add AffyTapple.com to the list.

Update 2. Add:

Update 3: Add:

Update 4: Add:

Update 5: Add:

Update 6: Add:

Update 7: Add:

Update 8: Add:

 

 

About the author: Dissent

6 comments to “Aptos malware breach affected 40 online retail stores”

You can leave a reply or Trackback this post.
  1. karen - March 17, 2017

    I’ve seen a few other breaches on various AG lists that sure sound like they could be connected to the Aptos breach, based on the dates in the notifications. For example, the Zest Dental Solutions breach…
    https://oag.ca.gov/system/files/ZST%20Notification%20Letter%20CA%20Sample%202_1.pdf?

    • Dissent - March 17, 2017

      I read that but didn’t think it could possibly be Aptos, as Zest reports a number of dates, starting in 2013, and the Aptos breach was confined to Feb – Dec. of 2016.

      • karen - March 20, 2017

        Abbottstores started in 2013 as well

        • Dissent - March 20, 2017

          No. The breach didn’t start in 2013 – it affected orders placed between because those data were still on the server.

  2. Anonymous - March 19, 2017

    Is there any way to get SPECIFIC dates on this breach, rather than just the months? I ordered from Alpha Industries mid-December, and I would rest easier just knowing that the breach had been closed BEFORE I placed my order, if anyway possible. This info must be available.

    • Dissent - March 19, 2017

      If you’re a customer, why not call them and ask them?

Comments are closed.