UK Shelly Reseller Reports Payment Data Breach via Malware
Unauthorized software on the Shelly Store UK website potentially compromised customer payment and personal information.
1Unauthorized Software Incident Detected
Shelly Store UK identified malicious software on its website following an alert from its payment processor, Stripe. The company confirmed that unauthorized code was present on both the website and the underlying server. They have since removed the malware, implemented security updates, and initiated continuous monitoring to prevent further unauthorized access attempts.
2Scope of Data Exposure
The breach potentially impacts customer names, billing addresses, contact details, and payment card information. While the company cannot definitively confirm which specific records were accessed or copied, they are actively contacting all customers who placed orders during the affected window. The investigation into the full extent of the data exfiltration remains ongoing.
3Customer Fraud Evidence
One affected customer reported a fraudulent transaction of £221.28 originating from Australia on October 26. This occurred shortly after their purchase on October 12, suggesting that card details were harvested between these dates. The incident highlights the immediate financial risks posed to consumers when e-commerce platforms suffer from server-side malware infections.
4Response and Regulatory Reporting
Shelly Store UK has formally reported the security incident to the Information Commissioner’s Office. The company is advising all impacted users to contact their respective card issuers to discuss potential card replacements. Additionally, they have urged customers to reset their account passwords and remain vigilant against phishing attempts requesting sensitive security codes.
5Operational Independence Clarified
Shelly Group, the manufacturer, clarified that Shelly Store UK is an independent reseller with no direct affiliation or ownership. The parent company confirmed it does not manage the reseller's website or business operations. This distinction is critical for customers to understand, as the breach is isolated to the third-party retailer's infrastructure.
6Security Remediation Measures
Beyond removing the malicious software, the reseller has strengthened its access security protocols. These measures are intended to harden the server environment against future unauthorized intrusions. The company maintains that it is taking the situation seriously and will provide further updates to customers as their internal investigation yields more specific information.
7E-commerce Security Vulnerabilities
This incident underscores the persistent threat of web-based malware targeting e-commerce checkout processes. By compromising the server, attackers can intercept payment data before it reaches the payment gateway. Retailers must maintain rigorous patch management and server-side integrity checks to protect customer data from such sophisticated and stealthy digital skimming attacks.
8Impact on Consumer Trust
The breach serves as a stark reminder of the risks associated with third-party resellers in the smart home ecosystem. Customers are now facing the inconvenience of monitoring transaction histories and managing potential identity theft. Moving forward, the reseller faces the challenge of restoring brand reputation while navigating the regulatory scrutiny of the ICO.