This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at http://www.theguardian.com/technology/2014/may/29/office-shoes-website-hack-passwords-personal-data

The article has changed 2 times. There is an RSS feed of changes available.

Version 0 Version 1
Shoe retailer Office urges users to change passwords after website hack Shoe retailer Office urges users to change passwords after website hack
(3 months later)
The UK shoe store Office is advising customers to change their passwords after its website suffered a break-in that compromised customer data.The UK shoe store Office is advising customers to change their passwords after its website suffered a break-in that compromised customer data.
No financial information was stolen in the hack, but customer names, addresses, email addresses, birth dates, birth months (but not year of birth), phone numbers and Office account passwords were stolen.No financial information was stolen in the hack, but customer names, addresses, email addresses, birth dates, birth months (but not year of birth), phone numbers and Office account passwords were stolen.
The company has not said whether the information was encrypted or how many customers had been affected.The company has not said whether the information was encrypted or how many customers had been affected.
“I can confirm that the Office website has been the subject of a security breach,” said chief executive Brian McCluskey in a statement. “We take such a threat very seriously and have been in communication with our customers to advise them of the matter.”“I can confirm that the Office website has been the subject of a security breach,” said chief executive Brian McCluskey in a statement. “We take such a threat very seriously and have been in communication with our customers to advise them of the matter.”
“We can confirm that no credit card, debit card, Paypal or bank details were compromised in any way. In addition we have reported the matter to the relevant authorities,” said McCluskey.“We can confirm that no credit card, debit card, Paypal or bank details were compromised in any way. In addition we have reported the matter to the relevant authorities,” said McCluskey.
‘Protection of customer data is of the utmost importance’‘Protection of customer data is of the utmost importance’
The company became aware of the attack on 22 May, launching an investigation that discovered the data breach on 26 May. Office has emailed affected customers, reset their passwords and has said that only accounts created prior to August 2013 were affected.The company became aware of the attack on 22 May, launching an investigation that discovered the data breach on 26 May. Office has emailed affected customers, reset their passwords and has said that only accounts created prior to August 2013 were affected.
Office said that it does not store financial data, including credit cards, PayPal or bank account information.Office said that it does not store financial data, including credit cards, PayPal or bank account information.
“The protection of customer data is of the utmost importance to us and we are treating this extremely seriously,” said McCluskey .“Our customers remain our number one priority and we are taking all necessary measures to ensure that our website remains secure.”“The protection of customer data is of the utmost importance to us and we are treating this extremely seriously,” said McCluskey .“Our customers remain our number one priority and we are taking all necessary measures to ensure that our website remains secure.”
'It's not a matter of 'if', but 'when'''It's not a matter of 'if', but 'when''
"This breach highlights a need for companies to place tighter controls on how their customers' sensitive information is stored and protected,” said Andy Heather, vice president of Voltage Security. “If data is left unprotected, it's not a matter of "if" it will be compromised - it's a matter of “when”.”"This breach highlights a need for companies to place tighter controls on how their customers' sensitive information is stored and protected,” said Andy Heather, vice president of Voltage Security. “If data is left unprotected, it's not a matter of "if" it will be compromised - it's a matter of “when”.”
Preventing access to user data has become an increasingly difficult challenge for companies, while companies like retailers and service providers are storing more and more personal data beyond financial information, explained Heather. Companies must therefore prepare for the worst and ensure that all customer data is encrypted at all times.Preventing access to user data has become an increasingly difficult challenge for companies, while companies like retailers and service providers are storing more and more personal data beyond financial information, explained Heather. Companies must therefore prepare for the worst and ensure that all customer data is encrypted at all times.
"If Office had employed format-preserving encryption to protect the data itself, the attackers would have ended up with unusable encrypted data instead of the current outcome where an untold amount of their customers' personal information is now in the hands of cyber criminals,” said Heather."If Office had employed format-preserving encryption to protect the data itself, the attackers would have ended up with unusable encrypted data instead of the current outcome where an untold amount of their customers' personal information is now in the hands of cyber criminals,” said Heather.
Personal information, like addresses, phone numbers and dates of birth, is extremely valuable to criminals, and can present a greater longterm threat to victims than simply stolen credit card details, which can easily be changed.Personal information, like addresses, phone numbers and dates of birth, is extremely valuable to criminals, and can present a greater longterm threat to victims than simply stolen credit card details, which can easily be changed.
"The value of this personal data to the cyber criminal has a much greater value, for example where the selling price for a single stolen credit card is around $1, if that card information is sold with a full identify profile that can dramatically increase up to $500,” explained Heather. "The value of this personal data to the cyber criminal has a much greater value, for example where the selling price for a single stolen credit card is around $1, if that card information is sold with a full identify profile that can dramatically increase up to $500,” explained Heather.
‘Personal information is not their plaything’‘Personal information is not their plaything’
The cyberattack on Office follows a spate of hack attacks including that of Tesco, Spotify and eBay, where personal data including dates of birth, addresses and phone numbers were stolen unencrypted from up to 145 million users globally.The cyberattack on Office follows a spate of hack attacks including that of Tesco, Spotify and eBay, where personal data including dates of birth, addresses and phone numbers were stolen unencrypted from up to 145 million users globally.
“This sort of thing is going to go on and on and on until businesses wake up and realise that personal information is not their plaything; it’s our information and it needs to be protected,” said Graham about eBay’s handling of personal data.“This sort of thing is going to go on and on and on until businesses wake up and realise that personal information is not their plaything; it’s our information and it needs to be protected,” said Graham about eBay’s handling of personal data.
Customers are urged to change their password for their Office online account, but also to change the passwords of any other site that uses the same login and password combination.Customers are urged to change their password for their Office online account, but also to change the passwords of any other site that uses the same login and password combination.
“Watch out for phishing emails appearing to come from Office – log into the Office site directly rather than clicking on a link in an email,” warned Ian Pratt, co-founder of security firm Bromium.“Watch out for phishing emails appearing to come from Office – log into the Office site directly rather than clicking on a link in an email,” warned Ian Pratt, co-founder of security firm Bromium.
Office was founded in 1981 as concession in London’s Kensington indoor market Hyper Hyper. It now operates 153 stores globally with concessions in House of Fraser, Harvey Nichols, Selfridges and Topshop.Office was founded in 1981 as concession in London’s Kensington indoor market Hyper Hyper. It now operates 153 stores globally with concessions in House of Fraser, Harvey Nichols, Selfridges and Topshop.
It was once owned and operated by Scottish entrepreneur Sir Tom Hunter before he sold it to private equity firm Silverfleet Capital.It was once owned and operated by Scottish entrepreneur Sir Tom Hunter before he sold it to private equity firm Silverfleet Capital.
• It's not 'if' but 'when' a site you use gets hacked. Here's how to protect yourself from the next eBay or Office hack• It's not 'if' but 'when' a site you use gets hacked. Here's how to protect yourself from the next eBay or Office hack