Newegg customers may have had their credit card information stolen

Cr00zng · 20 Sep 2018

The article states that this hack involved Magecart, which requires admin or other high level of access to be able to add the malicious javascript code.

Newegg is a PCI level 2, or possibly level 1 merchant and as such, it is required to comply with PCI Data Security Standard, PCI DSS for short. The following is just a short list of Newegg's non-compliance to PCI DSS:

No SSH/2FA for a limited number of production support
Control inbound production access with Web Application Firewall (explicit web pages whitelist)
Restrict outbound access to explicit whitelist
Monitor and alert/block website source code changes

I also question how the outside PCI DSS auditor could certify Newegg as "compliant" to PCI DSS requirement.

Nowadays, data breaches are daily occurences and all companies are excusing themselves by blaming "APT" (Advanced Persistent Threat) for the breach, instead of admitting that they had messed up. It's hard to blame them, when the regulatory agencies accept this bogus excuse and there's really no consequences for the companies. Except to their customers, of course...

EdTittel · 20 Sep 2018

Thanks for sharing. I switched to using PayPal with Newegg awhile back, too.
--Ed--

Zardoc · 20 Sep 2018

Cr00zng said:

I've been using virtual CC# for online purchases, with a dollar limit of the exact amount of my purchase and an expiration date of the following month, which I create at my CC providers website. For the last decade or so, I have never had an issue with my real CC#s being stolen...

Who do you use for CC# ?

Thanks.

masenshi · 20 Sep 2018

Check this tweet to see how bad their security is, they have Windows Server 2008 box accessible on the net

Dan Tentler on Twitter:

SoFine409 · 20 Sep 2018

Cr00zng said:

I've been using virtual CC# for online purchases, with a dollar limit of the exact amount of my purchase and an expiration date of the following month, which I create at my CC providers website. For the last decade or so, I have never had an issue with my real CC#s being stolen...

I do the same thing and sleep better at night for having done so. BTW, I use Citi Bank MasterCard.

Borg 386 · 21 Sep 2018

Some Newegg customers reportedly had their credit card info nicked, as hacking group Magecart strikes again.

Security researchers RiskIQ said Wednesday that Magecart inserted malicious code into the payments system of the hardware and electronics retailer and made off with charge card data.

The nasty code was running on the Newegg site from Aug. 14 until Sept. 18, according to RiskIQ, which researched the incident with cybersecurity firm Volexity. The attack affected both desktop and mobile customers, according to RiskIQ. It's unclear how many customers were hit.

Newegg didn't immediately respond to a request for comment on the RiskIQ report.

Newegg data breach exposed customer credit card info, says report - CNET

Josey Wales · 21 Sep 2018

Borg 386 said:

Newegg data breach exposed customer credit card info, says report - CNET

Newegg customers may have had their credit card information stolen - Windows 10 Forums

Already Posted Borg.

HRPuffnstuff · 21 Sep 2018

I almost ordered a fan from them during the breach period but had a bad feeling and went elsewhere so coming here and learning about this breach made me feel better for not doing business with them during that time frame.

I wonder if the fed will step in like they have with other companies and force them to make changes?