Daily deals website Catch of the Day last night revealed it had suffered a serious data breach in 2011 that led to customer passwords and a number of credit card details being stolen.
Catch of the Day, which also owns Scoopon and GroceryRun, among others, said it had been targeted by an "illegal cyber intrusion" which had compromised names, addresses, email details, hashed passwords and in some cases, credit card details. It said other websites in its portfolio had not been targeted.
Although the company said in its advisory it had reported the hacking to police, banks and credit card issuers "immediately" after the attack, it did not tell the Australian Privacy Commissioner until an unspecified time after the breach.
Catch of the Day decided only to now advise customers with accounts created before May 7 2011 to change their passwords because "technological advances" meant there was an increased risk of the stolen hashed passwords becoming compromised.
Users who had changed their password since May 2011 need take no action, it advised.
The company did not reveal how many customers were affected by the breach, but said "only a relatively small portion" of users had credit card details compromised.
It told users its security networks were "continually evolving" and had undergone "major upgrades" to keep in line with industry standards and best practices.
Catch of the Day's passwords are salted and it adopts "industry standard protection measures".
"We have better technology, better procedures and a bigger team dedicated to ensuring your experience with us is safe and secure. We regularly undertake external reviews and audits to ensure that our sites and your data are as secure as possible," Catch of the Day advised its customers.
"We sincerely apologise to our loyal customers that these events occured and can assure you that we have dedicated significant resources to security and privacy to avoid these events in the future."
Catch of the Day has been contacted by iTnews for further detail.
