Hot Topic Customer Data Could Be Compromised After Credential Stuffing Attack
US retail chain Hot Topic has revealed that a cyberattack late last year may have led to access to the accounts of some of its customers and the possibility that their data may have been compromised.
The fast fashion retail chain, known for catering to an audience ranging from “teenagers to young adults” with its alternative and “counterculture-related” clothing and accessories, has informed its customers that in November last year it detected “activity “suspicious login message”. in some of your customer rewards accounts.
“After careful investigation, we determined that unauthorized parties launched automated attacks against our website and mobile application on November 18, 19, and November 25, 2023, using valid account credentials (e.g., email addresses and passwords). ) obtained from an unknown third party. source,” the company said.
The attack described above is what is known as a credential stuffing attack, in which a threat actor uses a data set of known username and password combinations obtained in other attacks and attempts to use them on another site or service, with an automated script that continually attempts to log in with the stolen credentials.
The effectiveness of this attack depends on the tendency of users to reuse username and password combinations.
“Hot Topic was not the source of the account credentials used in these attacks,” Hot Topic added.
The retailer added that it has yet to determine whether any accounts were actually accessed in the credential stuffing attack, let alone whether any information was accessed or compromised.
Hot Topic said that if the accounts were accessed, the data that would have been accessed included names, email addresses, phone numbers, dates of birth, postal addresses and order history.
“Importantly, if you saved a payment card to your Hot Topic Rewards account, unauthorized parties would only have been able to see the last four digits of the card number,” it said.
Hot Topic said it has hired outside cybersecurity experts and has begun taking steps to protect its systems against future credential stuffing attacks.
It also launched a force password reset for users of their accounts in order to render the credentials data set unusable.
“Your privacy is of the utmost importance to us and we sincerely regret any concern this incident may cause you. “The security of your personal information remains one of Hot Topic’s top priorities,” he said.
Credential stuffing is an unsophisticated attack that, while potentially effective, can be thwarted by basic cyber hygiene, such as using different usernames and passwords (or passphrases for added security).
