Volusion volusion.com Volusion data breach: what happened and what to do
In autumn 2019 attackers planted card-skimming code that ran on checkout pages of stores built on Volusion's platform. Volusion said card details from a subset of merchants were taken.
View all 13,177 breaches- Breach date
- 7 Sept 2019
- Data exposed
- Credit cards
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Volusion is an online store platform. In autumn 2019, researchers found that a malicious script was loading on the checkout pages of stores that ran on it. The script came from a storage bucket in Volusion's Google Cloud setup, which meant the attackers had first got into Volusion's own infrastructure. Security reporters called it a Magecart attack, the name for card-skimming code planted on payment pages.
Volusion said it was alerted to a data security incident and resolved it within a few hours of notification. It said a limited portion of customer information was compromised from a subset of its merchants, that this included credit card information but not other personally identifying details, and that it wasn't aware of fraud linked to it. Breach notifications were filed with state attorneys general, including California and Washington. Those filings count residents of one state, so they aren't a total.
Outside analysts put the number of affected stores at more than 6,500, and some estimated far more. Volusion hasn't published a total number of people affected.
The risk here is mostly financial. A skimmer copies the card number, expiry date and security code as you type them in. With those, someone can try to make online purchases in your name. Card issuers usually have processes for disputing charges you didn't make, which is why the first step is to watch your statements.
This kind of attack is hard to spot as a shopper, because the store itself looks normal. If you bought from a small online store in 2019 and aren't sure which platform it used, assume the card could have been involved if you now see odd charges. Serus can't pull card data back from an incident like this. It monitors breach databases and the dark web for your details and alerts you.
Sources checked: darkreading.com, portswigger.net, scmagazine.com
Last verified against the official page:
What to do if you were in it
- 1
Watch your card statements and report charges you didn't make
Check the card you used on affected stores and tell your card issuer about any charge you don't recognize. The FTC's guidance on what to do after a breach is at https://www.identitytheft.gov/databreach.
- 2
Ask your card issuer about replacing the card
If a charge looks wrong, call the number on the back of the card. Issuers can block the card and send a new number.
- 3
Dispute charges you didn't make
Tell your issuer promptly and in writing if they ask. The FTC's page at https://www.identitytheft.gov/databreach lists next steps if your information is misused.
- 4
Expect phishing that mentions a purchase
Scammers use stolen details to sound credible. Don't click links in unexpected emails or texts about an order or a card; go to the store or your bank directly.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see where your details have shown up.
Official filings
- Washington Attorney General , filed 20 Apr 2020 : 14,111 people
Timeline
-
The breach happened
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the Volusion breach?
If you paid on an online store built on Volusion's platform during the incident period, your card could have been involved. Volusion said only a subset of merchants were affected, and it hasn't published a list.
What was exposed?
Volusion said credit card information was compromised and that other personally identifying details were not. Some outside analysts reported names and phone numbers as well.
How many people were affected?
Volusion hasn't published a total. State filings count only each state's residents, and analyst estimates of affected stores vary.
Should I change my password?
The reported exposure was payment data from checkout pages, not account passwords. Changing a password does nothing for a copied card number, so watch statements and ask your issuer about a new card instead.
Sources
- darkreading.com/cloud/magecart-attack-on-volusion-highlights-supply-chain-dangers
- portswigger.net/daily-swig/open-sesame-e-commerce-stores-count-the-cost-of-magecart-infection
- scmagazine.com/news/magecart-attack-on-e-commerce-service-impacts-sesame-street-store-and-many-more
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
