Aptos malware breach affected 40 online retail stores

Posted on by Dissent

Aptos, Inc.  provides e-commerce solutions for a number of online e-tailers. In November, 2016, Aptos discovered it had a malware breach from February, 2016 – December, 2016.  At law enforcement’s request, they delayed notification to their clients, so we are first finding out about it now as the clients begin to disclose the breach to their customers.

So far, I’ve found notifications from the following:

AbbottStore.com was notified by Aptos on February 6. They report that the breach affected orders placed online between June 2013 – Dec 2016. Data types include: names, postal and email addresses, phone numbers, credit card numbers and expiration dates. For customers ordering between April 11 – August 18, 2016 and November 12 – November 28, 2016, cvv codes were also compromised. They provide no explanation as to why they were storing all that credit card data going back so far. Their site is currently not taking orders online, and they are offering customers 12 months of AllClear ID services.

LibertyHardware.com was notified by Aptos on February 7. For their customers, information entered before September, 2016 was involved: names, postal and email addresses, phone numbers, credit card numbers and expiration dates. They, too, are offering customers 12 months of AllClear ID services.

MrsPrindables.com was notified on February 6. As with other Aptos clients, data types include: names, postal and email addresses, phone numbers, credit card numbers and expiration dates. Customers who used their call center for orders were also affected. They are offering customers 12 months of credit monitoring services with Kroll.  Of note, their notification to customers reports that

Aptos informed us that unauthorized person(s) electronically accessed and placed malware on Aptos’ platform holding information for 40 online retailers

so there are a lot more notifications to come, it seems.  This post will be updated as more notifications are spotted.

Update 1. Add AffyTapple.com to the list.

Update 2. Add:

Update 3: Add:

Update 4: Add:

Update 5: Add:

Update 6: Add:

Update 7: Add:

Update 8: Add:

 

 

Category: Breach IncidentsBusiness SectorMalwareOf NoteU.S.

6 thoughts on “Aptos malware breach affected 40 online retail stores”

    1. I read that but didn’t think it could possibly be Aptos, as Zest reports a number of dates, starting in 2013, and the Aptos breach was confined to Feb – Dec. of 2016.

        1. No. The breach didn’t start in 2013 – it affected orders placed between because those data were still on the server.

  2. Is there any way to get SPECIFIC dates on this breach, rather than just the months? I ordered from Alpha Industries mid-December, and I would rest easier just knowing that the breach had been closed BEFORE I placed my order, if anyway possible. This info must be available.

Comments are closed.