ZAGG Inc. is informing prospects that their bank card information has been uncovered to unauthorized people after hackers compromised a third-party utility supplied by the corporate’s e-commerce supplier, BigCommerce.
ZAGG is a client electronics equipment maker identified for its cell equipment, resembling display screen protectors, cellphone instances, keyboards, and energy banks. The Utah-based firm has an annual income of $600 million.
In line with the letter despatched to impacted people, the attacker breached the FreshClicks app supplied by BigCommerce and injected malicious code that stole buyers’ card particulars.
“We learned that an unknown actor injected into the FreshClick app malicious code that was designed to scrape credit card data entered as part of the checkout process for certain ZAGG.com customer transactions between October 26, 2024 and November 7, 2024.” – ZAGG
BigCommerce is an Austin-based software-as-a-service (SaaS) e-commerce platform supplier that serves a various vary of companies, from small enterprises to massive firms, throughout numerous industries and areas.
FreshClick is a third-party app that helps create functions and responsive web sites for the BigCommerce platform. It’s designed to boost the performance of digital shops and enhance buyer expertise.
Though FreshClick isn’t developed straight by BigCommerce, it’s provided by way of the platform’s app market, which is a curated area for retailers to search out and set up add-ons for his or her outlets.
In an announcement for BleepingComputer, BigCommerce emphasised that its programs weren’t breached or compromised. Utilizing inside instruments, BigCommerce found that the FreshClicks App had been hacked and uninstalled it from its prospects’ shops.
“Using our internal tools and in communication with the partner, we verified the third-party FreshClicks App was compromised. Acting in the best interest of our customers and their shoppers, we immediately uninstalled the app in their stores, which removed any compromised APIs and malicious code” – BigCommerce
Because of this information breach, the attacker stole names, addresses, and fee card information belonging to buyers at zagg.com between October 26 and November 7, 2024.
In response to this incident, ZAGG applied remediation measures, notified federal regulation enforcement and regulators, and organized for impacted people to obtain a free-of-charge, 12-month credit score monitoring service by way of Experian.
Letter recipients had been additionally suggested to observe monetary account exercise intently, place fraud alerts, and take into account putting a credit score freeze.
ZAGG has not disclosed but what number of prospects had been impacted by this safety breach.
BigCommerce’s retailer at the moment lists six add-ons created by FreshClick, which collectively have 178 critiques. Nevertheless, the compromised plugin might have been quickly eliminated.
