Graham Cluley, Sophos:
Zappos turns off phones after up to 24M customer records exposed
January 16, 2012
Online
shoe and clothing retailer Zappos.com has warned its users that it has
suffered a massive data breach.
Up to 24 million customers may have been impacted by the security
breach, which has forced the firm to reset the passwords of its
customers.
According to the company, which is owned by Amazon.com, details stolen
include names, email addresses, billing/shipping addresses, phone
numbers, and the last four digits of customers' credit card numbers.
In addition, password hashes were exposed.
So, you'll have to change your Zappos password if you want to shop from
the store again. And, actually, it would make sense to ensure that you
are not using the same password anywhere else on the net.
Disappointingly, there is no mention of the security breach on the front
page of the Zappos website - one platform you would imagine they would
use to inform their customers that there was a security problem of which
they should be made aware.
Zappos says it has taken the step of
temporarily turning off its phone lines, because it worries it will not
be able to cope with the volume of anticipated calls. Instead, customers
are being asked to contact the firm only via email.
And good luck if you have heard about the security incident, and try to
read Zappos' statement about the security incident online. The corporate
blog it is posted on is currently blocked to non-US customers:
Nevertheless, I managed to find the
full text of a statement from Zappos CEO Tony Hsieh via a Google cache
of the webpage. I've reproduced the content below in the hope that it
might help some of Zappos' customers:
The following email was sent to our employees today:
Date: Sun, 15 Jan 2012
From: Tony Hsieh (CEO - Zappos.com)
To: Zappos Employees
Subject: Important - Security
Dear Zappos Employees -
Please set aside 20 minutes to carefully read this entire email.
We were recently the victim of a cyber attack by a criminal who gained
access to parts of our internal network and systems through one of our
servers in Kentucky. We are cooperating with law enforcement to undergo
an exhaustive investigation.
Because of the nature of the investigation, the information in this
email is being sent a bit more formally, and unfortunately we are not
able to provide any more details about specifics of the attack beyond
what is in this email and the link at the end of this email, but we can
say that THE DATABASE THAT STORES OUR CUSTOMERS' CRITICAL CREDIT CARD
AND OTHER PAYMENT DATA WAS NOT AFFECTED OR ACCESSED.
The most important focus for us right now is the safety and security of
our customers' information. Within the next hour, we will begin the
process of notifying the 24+ million customer accounts in our database
about the incident and help step them through the process of choosing a
new password for their accounts. (We've already reset and expired their
existing passwords.)
Here is the email that our customers will be receiving:
Subject: Information on the Zappos.com site - please create a new
password
First, the bad news:
We are writing to let you know that there may have been illegal and
unauthorized access to some of your customer account information on
Zappos.com, including one or more of the following: your name, e-mail
address, billing and shipping addresses, phone number, the last four
digits of your credit card number (the standard information you find on
receipts), and/or your cryptographically scrambled password (but not
your actual password).
THE BETTER NEWS:
The database that stores your critical credit card and other payment
data was NOT affected or accessed.
SECURITY PRECAUTIONS:
For your protection and to prevent unauthorized access, we have expired
and reset your password so you can create a new password. Please follow
the instructions below to create a new password.
We also recommend that you change your password on any other web site
where you use the same or a similar password. As always, please remember
that Zappos.com will never ask you for personal or account information
in an e-mail. Please exercise caution if you receive any emails or phone
calls that ask for personal information or direct you to a web site
where you are asked to provide personal information.
PLEASE CREATE A NEW PASSWORD:
We have expired and reset your password so you can create a new
password.
Please create a new password by visiting Zappos.com and clicking on the
"Create a New Password" link in the upper right corner of the web site
and follow the steps from there.
We sincerely apologize for any inconvenience this may cause. If you have
any additional questions about this process, please email us at
passwordchange@zappos.com
In order to service as many customer inquiries as possible, we will be
asking all employees at our headquarters, regardless of department, to
help with assisting customers. Due to the volume of inquiries we are
expecting, we realized that we could serve the most customers by
answering their questions by email. We have made the hard decision to
temporarily turn off our phones and direct customers to contact us by
email because our phone systems simply aren't capable of handling so
much volume. (If 5% of our customers call, that would be over 1 million
phone calls, most of which would not even make it into our phone system
in the first place.)
We've spent over 12 years building our reputation, brand, and trust with
our customers. It's painful to see us take so many steps back due to a
single incident. I suppose the one saving grace is that the database
that stores our customers' critical credit card and other payment data
was not affected or accessed.
Over the next day or so, we will be training everyone on the specifics
of how to best help our customers through their password change process
now that their passwords have been reset and expired. We need all hands
on deck to help get through this.
Thanks everyone.
-Tony Hsieh
CEO - Zappos.com
It's
certainly an ugly situation - and if nothing else, the security breach
underlines the damage that can be done to a company's brand by an
attack.
Although many may find the decision to turn off the telephones hard to
swallow, but from the above statement it appears that the company is
attempting to assist as many customers as quickly as possible - and is
not adverse to calling in every member of staff, regardless of
department, to assist customers who have questions.
One imagines that the decision to block access to the blog entry is to
prevent it becoming overloaded with traffic - but, seriously, how hard
is it to host an important message like this on another trusted site?
Hey, I just did it for them above!
Zappos says that it is co-operating with the authorities in their
investigation as to who might have been behind the attack.
Graham Cluley is senior technology
consultant at Sophos. Follow him on
Twitter and
Google Plus for regular updates.
Online
shoe and clothing retailer Zappos.com has warned its users that it has
suffered a massive data breach.
