BSN Sports bsnsports.com BSN Sports data breach: what happened and what to do
BSN Sports, a team sports apparel and equipment retailer, told customers in February 2021 that payment card data was taken from its online checkout between April 24, 2019 and January 5, 2021. The Maine Attorney General's filing lists 23,834 people.
View all 13,177 breaches- Breach date
- 24 Apr 2019
- Made public
- 26 Feb 2021
- Affected
- 23,834
- Data exposed
- Credit cards
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
BSN Sports sells uniforms and gear to schools and teams. In February 2021 it sent breach notices to customers after discovering that an outside attacker had gained access to its online checkout. According to its filing with the Maine Attorney General, the access ran from April 24, 2019 to January 5, 2021, and the company found it on February 2, 2021. Notice letters went out on February 26, 2021.
The filing lists 23,834 people affected in total. The information involved was payment card or financial account details together with the code needed to use them, such as a security code. BSN Sports was also listed in the California and Washington Attorney General breach notices, which cover only residents of those states, so those figures are not the total.
A stolen card number can be used to make purchases until the card is cancelled. Because the window was almost two years long, anyone who shopped on the site in that period could be affected, and the card may have been replaced since. The company offered affected people one year of dark web monitoring.
If you got a letter, it will say which card details were involved. If you shopped there between those dates and aren't sure, check your statements for charges you don't recognize.
Sources checked: apps.web.maine.gov, oag.ca.gov, consumer.ftc.gov
Last verified against the official page:
What to do if you were in it
- 1
Check your card statements
Look through statements from April 2019 onward for charges you don't recognize, and report any to your card issuer right away.
- 2
Ask your card issuer for a new card
If you used a card on the BSN Sports site in that period and still have it, ask the issuer to replace it. The FTC recommends reporting fraud to the issuer promptly.
- 3
Consider a fraud alert or credit freeze
Card numbers alone don't open new accounts, but if you got a letter mentioning more details, the FTC explains how to place a fraud alert or free credit freeze at the credit bureaus. See consumer.ftc.gov.
- 4
Report identity theft if it happens
If someone opens an account or makes charges in your name, report it at IdentityTheft.gov and follow the recovery plan it gives you.
- 5
Check whether your email or phone is in this and other breaches
Serus runs a free scan that looks for your email and phone number in known breaches and alerts you if new ones appear.
Official filings
- Washington Attorney General , filed 26 Feb 2021 : 523 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the BSN Sports data breach?
If you got a notice letter, yes. The breach covers online checkout between April 24, 2019 and January 5, 2021. If you shopped online then and got no letter, ask your card issuer to check your account.
What was exposed?
Payment card or financial account details with the code needed to use them, according to the Maine Attorney General filing.
How many people were affected?
The Maine filing lists 23,834 people in total. Figures in California and Washington notices count only residents of those states.
Should I change my password?
The notice describes card data, not passwords. Changing the password on any account tied to a card you used there is still a reasonable step, and the FTC advises using a different password for each account.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
