Newegg is investigating a data breach that may have compromised credit card details and other information about its customers, though the full extent of the damage is not yet known.
"Yesterday, we learned one of our servers had been injected with malware which may have allowed some of your information to be acquired or accessed by a third party," Newegg CEO Danny Lee states in an email being sent out to potentially affected customers." The malware was quite sophisticated and we are conducting extensive research to determine exactly what information may have been acquired or accessed and how many customers may have been impacted."
In other words, there are more questions than answers at this point, at least from Newegg. According to joint research conducted by RiskIQ and Volexity, however, the culprit is a data hacking group called Magecart. This is the same hacking entity that stole credit card data from British Airways and Ticketmaster.
"It’s becoming clear to the industry that these simple yet clever attacks are not only devastating, they’re becoming more and more prevalent. Newegg is just the latest victim," RiskIQ stated in a blog post.
Researchers from RiskIQ and Volexity say the attackers installed credit card skimming malware onto Newegg's website. They injected the malicious code into Newegg's payment processing page, basically hiding in plain site for more than a month, the researchers say.
The stolen credit card data was then sent to a drop server on a domain the hackers had registered, initially parked at neweggstats.com. They obtained a security certificate for the site from Comodo so that it appeared legitimate.
"Around August 14th, the attackers placed the skimmer code on Newegg, managing to integrate it into the checkout process and achieve their goal of disguising it well," RiskIQ says.
If you've purchased anything at Newegg from on or around August 14 to September 18 this year, at minimum you should keep an eye on your credit card account, as Newegg suggests. It would be even better to request a new card with a new number.
Newegg is planning to publish a related FAQ by Friday that will hopefully address exactly what data was compromised, and how many customers were affected.
