Breaches and incidents
and ST HD (apparel group): business servers breached, about 2.5M customer records possibly leaked
In a TSE disclosure, and ST HD said that from about 7:30 am on 22 Oct an outside party made “login attempts, intrusion and data extraction” against several...
- Disclosed
- Verification
- Checked against a primary source
What happened
- In a TSE disclosure, and ST HD said that from about 7:30 am on 22 Oct an outside party made “login attempts, intrusion and data extraction” against several business servers; about 2.5M customer records (name, date of birth, gender, address, phone, email, member ID) and about 10,000 business-partner records may have leaked, with the employee scope still being checked.
- Root cause: not disclosed; the company said it detected the unauthorized operations around 10:00 am, isolated the servers and had “identified” the access method, without describing it. No card data or customer-set passwords were involved.
- No attacker named.
- Access routes were blocked by 5 pm on 22 Oct and internal business systems stopped; police were consulted and the PPC notified on 23 Oct; stores and the web store stay open but member points are unusable.