Hanna Andersson hannaandersson.com Hanna Andersson data breach: what happened and what to do
Malware on Hanna Andersson's checkout platform may have captured card details entered between September 16 and November 11, 2019. Exposed data included names, addresses, card numbers, CVV codes and expiry dates. The company didn't publish a total.
View all 13,177 breaches- Breach date
- 16 Sept 2019
- Data exposed
- Names, Physical addresses, Credit cards
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Hanna Andersson, a children's clothing retailer, sent notices to customers and to state attorneys general on January 15, 2020. According to reporting on those notices, investigators found that malware had been placed on Salesforce Commerce Cloud, the third-party e-commerce platform behind its website. The earliest possible compromise was September 16, 2019 and the malware was removed on November 11, 2019. The company said law enforcement told it on December 5, 2019 that card data from its site was being sold online.
Sources checked: oag.ca.gov, atg.wa.gov, securityaffairs.com
Last verified against the official page:
What was exposed
The malware may have captured what customers typed in during checkout: names, billing and shipping addresses, payment card numbers, CVV codes and expiration dates. Investigators couldn't tell exactly which records were taken, so the company notified everyone who bought during that window. The public state filings list residents of individual states, not a company-wide total, so no overall figure is available.
Card numbers with CVV codes can be used for online purchases until the card is replaced. Shipping addresses can also reveal where a child lives, which is one more reason to treat follow-up messages with care.
The response
The company notified customers and regulators and a class action followed. Reporting on the case says it settled with a fund for affected customers and commitments on cloud account security.
What to do if you were in it
- 1
Ask your card issuer for a new card
If you used a card on the site during that window, tell your bank or card issuer and ask for a replacement number.
- 2
Check statements for charges you don't recognize
Dispute any you find with your issuer. The FTC explains your options if your card details are used.
- 3
Consider a credit freeze
Card details alone don't open new accounts, but a free freeze at Equifax, Experian and TransUnion is the FTC's tool if you're worried about identity misuse.
- 4
Be careful with messages that mention the breach
Don't click links in emails or texts about it. Go to the company's site yourself.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new one.
Official filings
- Washington Attorney General , filed 15 Jan 2020 : 8,816 people
Timeline
-
The breach happened
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the Hanna Andersson data breach?
If you bought on hannaandersson.com between September 16 and November 11, 2019, your card details may have been captured, and the company says it notified those customers.
What was exposed?
Names, billing and shipping addresses, card numbers, CVV codes and expiration dates entered at checkout.
Should I change my password?
The notices describe checkout data rather than account passwords. Replacing the card is the step that matters most.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
