Garmin's private consumer data stolen

Credit: LuckyLife11 via Pixabay

“We recently discovered the theft of customer data from orders placed through shop.garmin.co.za that compromised your data related to an order that you placed through our website,” says Garmin SA MD Jennifer van Niekerk.

“The compromised data was limited to only Garmin’s South Africa site, and contained payment information, including the number, expiration date and CVV code for your payment card, along with your first and last name, physical address, phone number and email address.”

“We recommend that you review and monitor your payment card records to make sure there were no unauthorised purchases. If you suspect any fraud, please contact your bank or payment card provider for further direction. As a valued customer, we apologise for this incident and assure you that Garmin takes our obligation to safeguard personal data very seriously,” concludes van Nie Kerk.

There has been no clear word on what caused the breach, however, according to Sergiu Gatlan in an article for Beeping Computer, there are ‘signs that the online store portal was the victim of a Magecart group’.

Magecart attacks are usually associated with data skimming – essentially hackers use the ‘client-side browser’ as the front-door for consumer interactions. They gain access by planting malicious code onto websites – thus enabling them to record credit card information as consumers enter their private credentials on the checkout page.

Garmin has since temporarily suspended activity on the portal as explained by the following message: “The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.”