Skip to content

March 20, 2017

Saks Fifth Avenue left customer data exposed to the public

by John_A

Sometimes, hackers don’t have to lift a finger to swipe valuable shopping data — it can be sitting right out in the open. BuzzFeed News has found that a number of associated major fashion stores, including Saks Fifth Avenue, Gilt and Lord & Taylor, were storing info for tens of thousands of customers in plain text on their servers. There was no payment data, thankfully, but the content revealed email addresses, phone numbers, internet addresses and product IDs. If a malicious visitor wanted to commit identity fraud or scam a customer, they had at least some of what they needed.

The brands’ Canadian parent, Hudson’s Bay Company, has since taken the info down while it works on a solution, and says that only “some email addresses” were affected. HBC maintains that it follows “industry best practices” for security, but that isn’t really the case when anyone snooping around its web code could have found the info. BuzzFeed adds that the sites have an inconsistent approach to web encryption, protecting certain pages (such as the login page) but not others. Someone on the same local network could grab unencrypted web traffic and potentially use it to compromise an account.

While there’s currently no evidence to suggest that someone made off with the data before it was taken down, the discovery isn’t very reassuring. It suggests that online shops are still making basic security mistakes, and don’t always realize that even limited data exposure can be very dangerous. It only takes a nosy intruder to turn a blunder like this into a serious incident.

Source: BuzzFeed News

Advertisements
Read more from News

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Note: HTML is allowed. Your email address will never be published.

Subscribe to comments

%d bloggers like this: