Macy’s Online Customers Hit by Magecart Breach
"Macy’s is notifying some of its online customers that their card details have been skimmed as part of another Magecart data breach.
According to the breach notice, the firm only found out about the incident around a week after it happened, in early October.
“On October 15, 2019, we were alerted to a suspicious connection between macys.com and another website. Our security teams immediately began an investigation. Based on our investigation, we believe that on October 7, 2019 an unauthorized third party added unauthorized computer code to two pages on macys.com,” it said.
“The unauthorized code was highly specific and only allowed the third party to capture information submitted by customers on the following two macys.com pages: (1) the checkout page — if credit card data was entered and “place order” button was hit; and (2) the wallet page — accessed through My Account. Our teams successfully removed the unauthorized code on October 15, 2019.”
Affected customers are likely to have had their full card details and more swiped by the hackers: first name; last name; address; city; state; zip; phone number; email address; payment card number; payment card security code; payment card month/year of expiration."
"Macy’s is notifying some of its online customers that their card details have been skimmed as part of another Magecart data breach.
According to the breach notice, the firm only found out about the incident around a week after it happened, in early October.
“On October 15, 2019, we were alerted to a suspicious connection between macys.com and another website. Our security teams immediately began an investigation. Based on our investigation, we believe that on October 7, 2019 an unauthorized third party added unauthorized computer code to two pages on macys.com,” it said.
“The unauthorized code was highly specific and only allowed the third party to capture information submitted by customers on the following two macys.com pages: (1) the checkout page — if credit card data was entered and “place order” button was hit; and (2) the wallet page — accessed through My Account. Our teams successfully removed the unauthorized code on October 15, 2019.”
Affected customers are likely to have had their full card details and more swiped by the hackers: first name; last name; address; city; state; zip; phone number; email address; payment card number; payment card security code; payment card month/year of expiration."
