Staples discloses data breach exposing customer info

guest · Sep 14, 2020

Staples discloses data breach exposing customer info
September 14, 2020
https://www.bleepingcomputer.com/news/security/staples-discloses-data-breach-exposing-customer-info/

Giant office retail company Staples informed some of its customers that data related to their orders has been accessed without authorization.

Few details are available at the moment. The company has not disclosed the incident publicly and alerted affected customers individually over email.
'Non-sensitive data' accessed
It is important to note that Staples’ main business is selling office supplies and related products using retail channels and through business-to-business engagements.
Click to expand...

Security researcher Troy Hunt received the notification in a data breach report. It appears that “a limited amount” of order data for customers of Staples.com - suggesting that the Canadian website is not impacted - was accessed by an unauthorized party. This “may have included information about one of your orders,” the letter reads.

The retailer has yet to determine what exactly got accessed but it could contain what Staples classifies as "non-sensitive customer order data:" names, addresses, email addresses, phone numbers, last four credit card digits, details about the order (delivery, cost, product).
Recipients of the Staples data breach notification can learn more by calling Staples directly during business hours. They should choose option 3 to speak to a company representative.
Click to expand...

guest · Sep 16, 2020

Staples' order tracking system led to exposing customer info
September 16, 2020
https://www.bleepingcomputer.com/ne...racking-system-led-to-exposing-customer-info/

The reason for the recent notification from Staples to some of its customers about exposed order details was caused by insufficient protections for retrieving shopper information from current and past orders.

Staples said that they found no evidence of unauthorized purchases on behalf of impacted customers and that they fixed the issue.
Matching order ID and ZIP code
The alert lacks any technical details that would explain the nature of the problem, leading to some speculation that it was prompted by a hacker incident.
BleepingComputer learned that Staples had two endpoints that allowed customers to track their purchases using the order number and the postal code (ZIP) and one of them could reveal info on someone else’s order.
Click to expand...

By combining an order number with the correct delivery ZIP code, a hacker could call another endpoint to get the full order details of a customer.

From information received by BleepingComputer, not all customers that ordered from Staples recently received the email about their info being exposed.
Staples confirmed to BleepingComputer that the issue no longer exists. We learned that it took the company close to two weeks to solve the problem from the time they were alerted of the risk.
Click to expand...

Log in or Sign up

Staples discloses data breach exposing customer info

guest Guest

guest Guest

Log in or Sign up

Staples discloses data breach exposing customer info

guest Guest

guest Guest

Useful Searches