In what can only be considered a cybersecurity fumble, The Green Bay Packers American football team is notifying fans that a threat actor hacked its official online retail store in October and injected a card skimmer script to steal customers’ personal and payment information.
On October 23, 2024, we were alerted to the presence of malicious code inserted on the Pro Shop website by a third party threat actor. Immediately upon learning this, we temporarily disabled all payment and checkout capabilities on the Pro Shopwebsite and began an investigation. We engaged outside cybersecurity experts to assist with this investigation and determinewhat, if any, customer information may have been affected. We also immediately required the vendor that hosts and managesthe Pro Shop website to remove the malicious code from the checkout page, refresh its passwords, and confirm there wereno remaining vulnerabilities. Based on the results of the forensic investigation, on December 20, 2024 we discovered thatthe malicious code may have allowed an unauthorized third party to view or acquire certain customer information enteredat the checkout that used a limited set of payment options on the Pro Shop website between September 23-24, 2024 andOctober 3-23, 2024. Purchases on the Pro Shop website that were made using a gift card, Pro Shop website account,Paypal, or Amazon Pay, were not affected by this malicious code.
And:
The information that may have been accessed or acquired included certain information entered on the Pro Shop websitewhen making a purchase, and may have included your name, address (billing and shipping), email address, credit card type,credit card number, credit card expiration date, and credit card verification number.
Javvad Malik, Lead Security Awareness Advocate at KnowBe4, commented:
“The Packers’ response, upon discovery of the breach, is commendable. Disabling payment and checkout capabilities to stem further data exfiltration and engaging with external cybersecurity experts to delve into the breach’s extent. This response underscores the critical importance of prompt action and external expertise in managing cyber incidents.”
“The breach’s detection by Dutch e-commerce security company Sansec demonstrates not only how important third-party cybersecurity firms are, buy how keeping a vigilant eye out for cybersecurity issues shouldn’t be limited to just the internal security team. Rather third parties, employees, and the wider community can all play their part in identifying and notifying potential breaches. This creates a culture of security where everyone is helping each other stay secure.”
“The breach serves as a compelling case for the need for constant vigilance, regular security audits, and the implementation of robust security frameworks that can adapt to evolving threats. Especially for e-commerce platforms, where customer trust is paramount, the investment in security is not just a regulatory requirement but a fundamental business need.”
“This incident also highlights an ongoing challenge within cybersecurity: the necessity to balance user experience with security measures. Often, the most secure system is the one that is least usable, yet in the world of retail, usability is king. Finding that equilibrium, where security measures do add a disproportionate amount of friction to the user experience is the key.”
The Packers like any organization who gets pwned will have to regain the trust of its users. That won’t be easy. But given how loyal their fan base is, they might be able to score a touchdown on that front. Or at the very least kick a field goal.
Like this:
Like Loading...
Related
This entry was posted on January 7, 2025 at 1:00 pm and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
The Green Bay Packers Online Store Has Been Pwned By Hackers
In what can only be considered a cybersecurity fumble, The Green Bay Packers American football team is notifying fans that a threat actor hacked its official online retail store in October and injected a card skimmer script to steal customers’ personal and payment information.
On October 23, 2024, we were alerted to the presence of malicious code inserted on the Pro Shop website by a third party threat actor. Immediately upon learning this, we temporarily disabled all payment and checkout capabilities on the Pro Shopwebsite and began an investigation. We engaged outside cybersecurity experts to assist with this investigation and determinewhat, if any, customer information may have been affected. We also immediately required the vendor that hosts and managesthe Pro Shop website to remove the malicious code from the checkout page, refresh its passwords, and confirm there wereno remaining vulnerabilities. Based on the results of the forensic investigation, on December 20, 2024 we discovered thatthe malicious code may have allowed an unauthorized third party to view or acquire certain customer information enteredat the checkout that used a limited set of payment options on the Pro Shop website between September 23-24, 2024 andOctober 3-23, 2024. Purchases on the Pro Shop website that were made using a gift card, Pro Shop website account,Paypal, or Amazon Pay, were not affected by this malicious code.
And:
The information that may have been accessed or acquired included certain information entered on the Pro Shop websitewhen making a purchase, and may have included your name, address (billing and shipping), email address, credit card type,credit card number, credit card expiration date, and credit card verification number.
Javvad Malik, Lead Security Awareness Advocate at KnowBe4, commented:
“The Packers’ response, upon discovery of the breach, is commendable. Disabling payment and checkout capabilities to stem further data exfiltration and engaging with external cybersecurity experts to delve into the breach’s extent. This response underscores the critical importance of prompt action and external expertise in managing cyber incidents.”
“The breach’s detection by Dutch e-commerce security company Sansec demonstrates not only how important third-party cybersecurity firms are, buy how keeping a vigilant eye out for cybersecurity issues shouldn’t be limited to just the internal security team. Rather third parties, employees, and the wider community can all play their part in identifying and notifying potential breaches. This creates a culture of security where everyone is helping each other stay secure.”
“The breach serves as a compelling case for the need for constant vigilance, regular security audits, and the implementation of robust security frameworks that can adapt to evolving threats. Especially for e-commerce platforms, where customer trust is paramount, the investment in security is not just a regulatory requirement but a fundamental business need.”
“This incident also highlights an ongoing challenge within cybersecurity: the necessity to balance user experience with security measures. Often, the most secure system is the one that is least usable, yet in the world of retail, usability is king. Finding that equilibrium, where security measures do add a disproportionate amount of friction to the user experience is the key.”
The Packers like any organization who gets pwned will have to regain the trust of its users. That won’t be easy. But given how loyal their fan base is, they might be able to score a touchdown on that front. Or at the very least kick a field goal.
Share this:
Like this:
Related
This entry was posted on January 7, 2025 at 1:00 pm and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.