Lime Crime limecrime.com Lime Crime data breach: what happened and what to do
Malware was installed on the server hosting limecrime.com on October 4, 2014. Lime Crime learned of it on February 11, 2015. Its notice says usernames and passwords of customers who paid with PayPal between October 4, 2014 and February 15, 2015 could have been compromised.
View all 13,177 breaches- Breach date
- 4 Oct 2014
- Data exposed
- Usernames, Passwords
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Lime Crime, the cosmetics brand, told customers that unauthorized individuals installed malicious software on the computer server that hosted limecrime.com on October 4, 2014. The company says it learned of this on February 11, 2015, after a forensic investigation.
The notice letter Lime Crime filed with the California Attorney General covers customers who paid with PayPal between October 4, 2014 and February 15, 2015. For them, the company says the malware could have compromised their limecrime.com username and password. Because PayPal handled the payment, the letter says their credit and debit card details were not at risk.
Sources checked: oag.ca.gov, consumer.ftc.gov
Last verified against the official page:
What the exposure means
A leaked username and password is a problem mostly if you used the same password somewhere else. Criminals try stolen logins on other sites, a method called credential stuffing. If your Lime Crime password matched your email or shopping password, those accounts are the ones to protect first.
What Lime Crime did
The company took the website offline, replaced its e-commerce platform with a new one that it says passed a vulnerability scan and code review and is PCI compliant, and forced a password reset on the site. It offered affected customers one year of Experian identity protection and fraud resolution services, with an enrollment deadline of February 19, 2016. That deadline has passed.
The notice also suggests checking your credit reports for accounts you didn't open, and describes how to place a fraud alert or security freeze.
If you bought from Lime Crime in 2014 or 2015
The incident is old, but old passwords stay useful to criminals. Check the steps below if you still use a password from that time on any account.
What to do if you were in it
- 1
Change any password you reused
If your Lime Crime password was also your password for email, banking or other shops, change it on those accounts now. Use a different password for each account, ideally from a password manager.
- 2
Turn on two-factor login
Turn on two-factor authentication on your email and any account that holds payment details. It stops a stolen password from being enough on its own.
- 3
Check your credit reports
Lime Crime's notice recommends looking for accounts you didn't open. You can get free reports at annualcreditreport.com. The FTC explains how a credit freeze and fraud alert work if you want to add one.
- 4
Check whether your email is in this and other breaches
Run a free scan with Serus to see where your email shows up in breach databases. Serus alerts you and tells you what to do. It can't remove data from a breach.
Official filings
- California Attorney General , filed 24 Feb 2015
Timeline
-
The breach happened
-
Reported to the California Attorney General
Frequently asked
Was I affected by the Lime Crime breach?
The notice was sent to customers who paid with PayPal on limecrime.com between October 4, 2014 and February 15, 2015. If you got that letter or bought in that window, assume you were.
What was exposed?
The notice says limecrime.com usernames and passwords of PayPal customers could have been compromised. It says their credit and debit card details were not at risk.
Should I change my password?
Yes, if you ever reused your Lime Crime password. Change it everywhere you used it and use a unique one for each account.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
