An undisclosed number of customers of outdoor clothing retailer The North Face have had their passwords reset by the company, following a credential-stuffing attack.The company has revealed that on October 9, 2020, it became aware that hackers had used usernames and passwords stolen from a third-party website to gain unauthorised access to customer accounts.In a data breach notification sent to affected customers, The North Face explained that the hackers may have gained access to account information – including products previously purchased on its website, products that have been saved to “favorites”, billing and shipping addresses, names, birthdays, telephone numbers, email preferences, and loyalty point totals.Fortunately, The North Face does not store payment card details and so the firm is confident that that credit card information is not at risk.The North Face says that it “does not believe the attacker obtained information from us that would require us to notify you of a data security breach under applicable law, but we are notifying you of the incident voluntarily, out of an abundance of caution.”Nonetheless, it does sound as if some unauthorised purchases may have been made as a result of the security breach. The North Face told Bleeping Computer that it will offer full refunds for any purchases made by the hackers.Credential-stuffing attacks exploit the fact that many people make the mistake of using passwords that they had previously used elsewhere on the internet. (As I say over-and-over again, you should never reuse your passwords. It’s a recipe f ..
Support the originator by clicking the read the rest link below.
