ZAGG Inc. is informing prospects that their bank card knowledge has been uncovered to unauthorized people after hackers compromised a third-party software offered by the corporate’s e-commerce supplier, BigCommerce.
ZAGG is a shopper electronics equipment maker recognized for its cellular equipment, akin to display screen protectors, cellphone instances, keyboards, and energy banks. The Utah-based firm has an annual income of $600 million.
In keeping with the letter despatched to impacted people, the attacker breached the FreshClicks app offered by BigCommerce and injected malicious code that stole customers’ card particulars.
“We realized that an unknown actor injected into the FreshClick app malicious code that was designed to scrape bank card knowledge entered as a part of the checkout course of for sure ZAGG.com buyer transactions between October 26, 2024 and November 7, 2024.” – ZAGG
BigCommerce is an Austin-based software-as-a-service (SaaS) e-commerce platform supplier that serves a various vary of companies, from small enterprises to massive firms, throughout numerous industries and areas.
FreshClick is a third-party app that helps create purposes and responsive web sites for the BigCommerce platform. It’s designed to reinforce the performance of digital shops and enhance buyer expertise.
Though FreshClick isn’t developed straight by BigCommerce, it’s supplied by the platform’s app market, which is a curated area for retailers to seek out and set up add-ons for his or her outlets.
In an announcement for BleepingComputer, BigCommerce emphasised that its programs weren’t breached or compromised. Utilizing inner instruments, BigCommerce found that the FreshClicks App had been hacked and uninstalled it from its prospects’ shops.
“Utilizing our inner instruments and in communication with the associate, we verified the third-party FreshClicks App was compromised. Performing in the perfect curiosity of our prospects and their customers, we instantly uninstalled the app of their shops, which eliminated any compromised APIs and malicious code” – BigCommerce
On account of this knowledge breach, the attacker stole names, addresses, and cost card knowledge belonging to customers at zagg.com between October 26 and November 7, 2024.
In response to this incident, ZAGG applied remediation measures, notified federal legislation enforcement and regulators, and organized for impacted people to obtain a free-of-charge, 12-month credit score monitoring service by Experian.
Letter recipients have been additionally suggested to observe monetary account exercise carefully, place fraud alerts, and think about inserting a credit score freeze.
ZAGG has not disclosed but what number of prospects have been impacted by this safety breach.
BigCommerce’s retailer at the moment lists six add-ons created by FreshClick, which collectively have 178 evaluations. Nonetheless, the compromised plugin could have been quickly eliminated.