SlickWraps Allegedly Hacked, Financial and Customer Info Exposed

guest · Feb 24, 2020

SlickWraps Allegedly Hacked, Financial and Customer Info Exposed
February 21, 2020
https://www.bleepingcomputer.com/ne...y-hacked-financial-and-customer-info-exposed/

A security researcher has stated that they have allegedly hacked SlickWraps and after receiving no response to emails, publicly disclosed how they gained access to the site and the data that was exposed.

Using this access, Lynx stated that they were allegedly able to gain access to the resumes of employees, 9GB of personal customer photos, ZenDesk ticketing system, API credentials, and personal customer information such as hashed passwords, addresses, email addresses, phone numbers, and transactions.
After trying to report these breaches to SlickWraps, Lynx stated they were blocked multiple times even when stating they did not want a bounty, but rather for SlickWraps to disclose the data breach.

"They had no interest in accepting security advice from me. They simply blocked and ignored me," Lynx stated in the Medium post.
Click to expand...

When we asked why they continued to look for more vulnerabilities instead of simply contacting SlickWraps when they first gained access we were told:

"As a white hat, we want to see how far we can go so we can generate a full report. No point in doing research and reporting the first vulnerability when there's still 10 others."
Click to expand...

I hacked SlickWraps. This is how. [archived version]

Before I begin, it is important to note that I have exhausted all other options.
I notified SlickWraps multiple times of their egregious security vulnerabilities which (still) exist on their Magento-based eCommerce platform.

Their time is now up.
Let’s start at the beginning. [...]
Click to expand...

ReverseGear · Feb 21, 2020

Got a mail too

guest · Feb 21, 2020

Slickwraps has been hacked, customer data is compromised (Update: Statement)
Poor security has led to multiple breaches into Slickwraps databases
February 21, 2020
https://www.androidpolice.com/2020/02/21/slickwraps-has-been-hacked-customer-data-is-compromised/

[...] UPDATE: 2020/02/21 11:30AM PST BY CORBIN DAVENPORT
Slickwraps has sent out an email to customers explaining that the vulnerability did not leak "passwords or personal financial data," but did include names, emails, shipping addresses, and other data. Here's the full message:

[...] We are reaching out to you because we’ve made a mistake in violation of that trust. On February 22nd, we discovered information in some of our non-production databases was mistakenly made public via an exploit. During this time, the databases were accessed by an unauthorized party.

As an additional security measure, we recommend that you reset your Slickwraps account password. Again, no passwords were compromised, but we recommend this as a standard safety measure. Finally, please be watchful for any phishing attempts.
We are deeply sorry for this oversight. We promise to learn from this mistake and will make improvements going forward. [...]

More details will follow and we appreciate your patience during this process.
Click to expand...

guest · Feb 22, 2020

Data has been added to Have I Been Pwned:

Slickwraps
In February 2020, the online store for consumer electronics wraps Slickwraps suffered a data breach. The incident resulted in the exposure of 858k unique email addresses across customer records and newsletter subscribers. Additional impacted data included names, physical addresses, phone numbers and purchase histories.

Breach date: 16 February 2020
Date added to HIBP: 22 February 2020
Compromised accounts: 857,611
Compromised data: Email addresses, Names, Phone numbers, Physical addresses, Purchases
Permalink
Click to expand...

mood said: ↑

Slickwraps has been hacked, customer data is compromised (Update: Statement) February 21, 2020
Click to expand...

(Update: Email notifications) (February 22, 2020)

UPDATE 2: 2020/02/22 12:14PM PST BY CORBIN DAVENPORT
If you're not sure if you've been affected, the databases have now been uploaded to Have I Been Pwned, so you can enter your email address on that site to check. The service says that the breach affected over 857,000 accounts.
Click to expand...

guest · Feb 25, 2020

Slickwraps apologizes to customers after comically bad data breach
The company says the exploit has been fixed
February 25, 2020
https://www.theverge.com/2020/2/25/21153434/slickwraps-apologizes-customers-bad-data-breach

Yesterday, Slickwraps’ CEO posted a solemn apology video on Twitter, where he said the company has already started work on a new website with a new phone case customization page that it aims to launch this year.

A message from Slickwraps to our customers pic.twitter.com/z9huO9oN88
— Slickwraps (@SlickWraps) February 25, 2020
In its blog post, Slickwraps says the exploit has been repaired, that “all data is secured,” and that it’s working with a “third-party cybersecurity team” for analysis of the situation. The FBI has also opened an investigation, the company says.

The Verge reached out to hello@slickwraps.com for comment but have not yet received a reply. The phone number on the company’s press contact page is out of service, and the link on that page to send a press email links to a blank email address.
Click to expand...

guest · Mar 14, 2020

[paywalled]
Phone Case Maker Faces Class Action Over Customer Data Breach
March 13, 2020
https://news.bloomberglaw.com/class...-faces-class-action-over-customer-data-breach

A manufacturer of vinyl cases for phones, tablets, and other electronic devices didn’t do enough to shield customers from a recent massive data breach, a new class action alleges.

Slickwraps Inc. experienced a breach in February which resulted in the exposure of the personally identifiable information—including names, addresses, phone numbers, and email addresses—of about 858,000 customers, according to the complaint. The company’s phone case customization webpage had a vulnerability that allowed anyone to access virtually its entire network, plaintiffs Albert Almeida, Mark Munoz, and Angelo Victoriano claim.

A cybersecurity analyst going by the pseudonym Lynx0x00 announced in a Feb....
Click to expand...

guest · Mar 22, 2020

no paywall:
‘Comically Bad Security’: Slickwraps Hit with Class Action Over Data Breach Affecting 858k Customers
March 16, 2020
https://www.classaction.org/news/co...ion-over-data-breach-affecting-858k-customers

Slickwraps Inc. has been hit with a proposed class action lawsuit over a February 2020 data breach that a consumer alleges stemmed from the cell phone and tablet case maker’s “comically bad” cybersecurity.

According to the lawsuit, a cybersecurity analyst known as “Lynx0x00,” reportedly investigating the defendant’s pricing practices, announced on February 21 in a now-deleted blog post that they had accessed the personal information of Slickwraps customers the previous month.
As the lawsuit puts it, Slickwraps was well aware that its data security fell well below an acceptable standard yet did nothing despite the threat of its customers’ information being compromised or stolen.

“To say that Slickwraps ‘suffered’ a data breach is, to put it mildly, being charitable,” the complaint scathes. “Slickwraps was well aware that it had lax data security measures and did absolutely nothing to prevent the very kind of cyber security incident that occurred.”
Click to expand...

The lawsuit looks to represent a nationwide class and California-only subclass of consumers whose information was compromised as a result of the Slickwraps data breach announced around February 21, 2020.
Click to expand...

Log in or Sign up

SlickWraps Allegedly Hacked, Financial and Customer Info Exposed

guest Guest

ReverseGear Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

SlickWraps Allegedly Hacked, Financial and Customer Info Exposed

guest Guest

ReverseGear Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches