Forest Global Training Partners

Cyber Risks · Krebs on Security

Password Thieves Target E-Giftcard Firm Gyft

Summary: Digital gift card retailer Gyft forced a password reset for a subset of its customers after attackers acquired their usernames and passwords, a theft KrebsOnSecurity learned of from a cybercrime source offering the data for sale. Gyft declined on-the-record comment and said its own platforms were never breached, pointing to an unnamed third party, while executives said the affected share of users was in the "high single digits" and that they first learned of the issue about three weeks earlier.

Key Takeaway: Stolen Gyft credentials are valuable beyond Gyft because crooks recycle username and password pairs across dozens of other retailers, and the company does not appear to offer two-step authentication on its site.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related