Jared, Kay Jewelers Parent Fixes Data Leak
Summary: Signet Jewelers, parent of Jared and Kay Jewelers, fixed a flaw in jared.com and kay.com that exposed order details for online customers, including name, billing and shipping address, phone, email, items, total purchase, delivery date, tracking link, and the last four digits of the credit card number. Signet CISO Scott Lancaster said the company fixed the issue for new orders after a customer complaint in early November 2018 but did not address past orders until KrebsOnSecurity contacted the company.
What's compelling: Developer Brandon Sheehy showed that altering the link in a confirmation email revealed another customer's order, and he noted the last four card digits could support a convincing phone scam or targeted phishing; the exposure sat unfixed for past orders for weeks after Signet knew of it.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026