So I just read this from PC Gamer, luckily I've never purchased anything from Newegg:
Hackers installed ‘sophisticated’ malware on Newegg’s servers to steal customer data
If you've purchased anything at Newegg from on or around August 14 to September 18 this year, at minimum you should keep an eye on your credit card account, as Newegg suggests.
"Yesterday, we learned one of our servers had been injected with malware which may have allowed some of your information to be acquired or accessed by a third party," Newegg CEO Danny Lee states in an email being sent out to potentially affected customers." The malware was quite sophisticated and we are conducting extensive research to determine exactly what information may have been acquired or accessed and how many customers may have been impacted."
In other words, there are more questions than answers at this point, at least from Newegg. According to joint research conducted by RiskIQ and Volexity, however, the culprit is a data hacking group called Magecart. This is the same hacking entity that stole credit card data from British Airways and Ticketmaster.
The stolen credit card data was then sent to a drop server on a domain the hackers had registered, initially parked at neweggstats.com. They obtained a security certificate for the site from Comodo so that it appeared legitimate.
"Around August 14th, the attackers placed the skimmer code on Newegg, managing to integrate it into the checkout process and achieve their goal of disguising it well," RiskIQ says.
Hackers installed ‘sophisticated’ malware on Newegg’s servers to steal customer data
If you've purchased anything at Newegg from on or around August 14 to September 18 this year, at minimum you should keep an eye on your credit card account, as Newegg suggests.
"Yesterday, we learned one of our servers had been injected with malware which may have allowed some of your information to be acquired or accessed by a third party," Newegg CEO Danny Lee states in an email being sent out to potentially affected customers." The malware was quite sophisticated and we are conducting extensive research to determine exactly what information may have been acquired or accessed and how many customers may have been impacted."
In other words, there are more questions than answers at this point, at least from Newegg. According to joint research conducted by RiskIQ and Volexity, however, the culprit is a data hacking group called Magecart. This is the same hacking entity that stole credit card data from British Airways and Ticketmaster.
The stolen credit card data was then sent to a drop server on a domain the hackers had registered, initially parked at neweggstats.com. They obtained a security certificate for the site from Comodo so that it appeared legitimate.
"Around August 14th, the attackers placed the skimmer code on Newegg, managing to integrate it into the checkout process and achieve their goal of disguising it well," RiskIQ says.
