Shopify reports 'rogue' employees stole some customer data

guest · Sep 23, 2020

Shopify reports 'rogue' employees stole some customer data
Shopify support employees were trying to steal transaction records from online stores
September 23, 2020
https://www.engadget.com/shopify-data-breach-035811917.html

We’ve seen all kinds of data breaches from outside hackers, and occasionally, as happened with Twitter, breaches that occurred as outsiders phished employeee credentials for access, but for Shopify, the threat came from inside.

The company’s software enables online shopping for other businesses, and in a blog post it revealed that two employees were caught “in a scheme to obtain customer transactional records of certain merchants.”
It’s unclear how much data they actually stole, which the blog post said came from fewer than 200 merchants.
Click to expand...

Shopify didn’t list the affected stores, but says it did inform them directly.
Bloomberg reports that Pure, a cosmetics seller, notified customers of the breach, saying it occurred on September 15th. For now, you’ll probably have to keep an eye on your inbox, as it may not be obvious which sellers you interact with rely on the popular Shopify software kit.
Click to expand...

Spotify: Incident Update

Recently, Shopify became aware of an incident involving the data of less than 200 merchants. We immediately launched an investigation to identify the issue--and impact--so we could take action and notify the affected merchants.

Our investigation determined that two rogue members of our support team were engaged in a scheme to obtain customer transactional records of certain merchants. We immediately terminated these individuals’ access to our Shopify network and referred the incident to law enforcement.
Click to expand...

Complete payment card numbers or other sensitive personal or financial information were not part of this incident.
Click to expand...

guest · Sep 25, 2020

Lessons to Learn From Shopify Data Breach
September 24, 2020
https://www.inforisktoday.com/lessons-to-learn-from-shopify-data-breach-a-15055

Shopify's announcement this week that two employees inappropriately accessed transactional data from 200 of the merchants that use its e-commerce platform demonstrates the importance of taking a "zero trust" approach to security and improving identity and access management capabilities, security experts say.

Security teams must take steps to ensure only workers with the proper credentials have access to critical data, says Bryan Skene, CTO of the network-access security firm Tempered.

"Many organizations have rightfully chosen to adopt a zero trust policy to counter insider threats like the ones seen at Shopify," Skene says (see: Panel Discussion: Zero Trust in Action - Practical Deployments).
"The very tools that are making it easy to collaborate and get work done in a remote work environment - Slack, Teams, One Drive, Google Drive - are also making it easier to exfiltrate data like product ideas, source code and customer lists," Jadee Hanson, CISO and CIO at the security firm Code42, tells Information Security Media Group.
Click to expand...

With so many employees working from home, Hanson says organizations must have tools in place that give visibility into file movements, enabling them to verify that corporate intellectual property and sensitive data is not leaving the organization.
Click to expand...

guest · Sep 30, 2020

Kylie Jenner's make-up firm warns of Shopify data breach
September 30, 2020
https://www.bbc.com/news/technology-54354526

Shopify said two "rogue" support-team workers had stolen customer data from at least 100 sellers on its platform.
Kylie Cosmetics said it was among those affected but was confident customers could continue to buy on its Shopify-run website.

"And we wanted to let you know we're working diligently with Shopify to get additional information about this incident and their investigation and response to this matter.
"Shopify has assured us that they have implemented additional controls designed to help prevent this type of incident from recurring in the future."
Click to expand...

Log in or Sign up

Shopify reports 'rogue' employees stole some customer data

guest Guest

guest Guest

guest Guest

Log in or Sign up

Shopify reports 'rogue' employees stole some customer data

guest Guest

guest Guest

guest Guest

Useful Searches