Signet Jewelers, the company that owns Jared and Kay Jewelers, has solved a massive data breach that allows anyone to view information on orders from other customers, including a home address and the last four digits of the credit card. 39, buyer, according to a report on Monday.
The problem came to light in mid-November, when a Dallas web designer named Brandon Sheehy bought a pair of earrings for his girlfriend online.
Sheehy found that when he changed the link in the confirmation e-mail only slightly, and pasted it in a web browser, he could see another customer's order. The information clearly showed the name, the name, the shipping address and billing address of the customer, the telephone number, the e-mail address, all items and total amounts, the delivery date, the tracking link and the last four digits of the customer's credit card number.
"My first thought was that they could track down a jewelry package on someone's door and take it out of their door," he said. "My second thought was that someone could call Jared's customers and pretend to be Jared, read the last four digits of the customer's card and say that there was a problem with the order, and if they could get a different card for the customer could do it right away and get the order quickly, it would be a pretty convincing scam or just targeted phishing attacks. "
Sheehy contacted Signet Jewelers and asked them to fix the problem, she said, but she could still see the information for weeks.
Scott Lancaster, Signet's chief information security officer, said the company solved the problem for all future orders, but until recently it did not solve the problem with previous orders.
"When a customer first brought this problem to our attention at the beginning of November, we corrected it for all new orders in the future," said Lancaster. "But at the moment we did not realize that this applied to all past orders and future orders."
[ad_2]Source link
