Forest Global Training Partners

Cyber Risks · Krebs on Security

CVS Probes Card Breach at Online Photo Unit

Summary: CVS shut down CVSphoto.com and replaced it with a notice warning that customer credit card data collected by the independent vendor who manages and hosts the site may have been compromised, while stating that CVS.com and in-store transactions are unaffected. The incident followed Walmart Canada's investigation of a similar breach at its online photo site, and The Globe and Mail reported that vendor as PNI Digital Media, whose platform also serves Costco, Walmart Canada and CVS/pharmacy; Costco and Rite Aid subsequently suspended their photo sites, and PNI was acquired a year earlier by Staples, which suffered a six-month card breach that stole more than a million customer card accounts.

Bottom line: One third-party photo platform tied to more than 18 million transactions a year became the single point of exposure for CVS, Walmart Canada, Costco and Rite Aid at once - and its owner Staples had already absorbed a six-month breach affecting over a million card accounts.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related