Shelly Store UK says unauthorized software on its website may have copied card details, and one customer saw a charge from Australia before any warning.
A UK online shop that sells Shelly smart home gadgets has told customers their card details may have been stolen. Shelly Store UK says it found unauthorized software on its website and server. One customer says a charge appeared on their card from Australia before the shop said anything.
The shop says its payment provider, Stripe, sent a warning. It then found the software, removed it, tightened access security, applied updates and added ongoing monitoring. It has also reported the incident to the Information Commissioner's Office.
The shop could not say whether customer data was actually accessed or copied. It is contacting everyone who ordered during a window it has not specified. Besides card details, names, billing addresses and contact details may be exposed. Its investigation is still ongoing.
One customer told The Register they disputed a £221.28 charge, dated October 26, made in Australia with their card. They ordered once, on October 12, and got the shop's notice on October 27. They suspect the card was copied in between. That link is their suspicion, not a confirmed finding.
Customers of Shelly Store UK are the ones at risk. The store is an independent reseller. Shelly Group says it is not part of, owned by, or directly affiliated with the store, and that it does not manage the store's website.
The steps in the alert box above cover what to do now. Also be wary of any message that asks for card details or security codes, even one that looks like it comes from the shop.
The shop has not said how many customers are affected, which dates are covered, or how the software got onto its systems. Shelly Store UK did not immediately respond to The Register's request for more details. It says it will contact customers if it learns more.
If you ordered from Shelly Store UK, check your card statement now and ask your bank whether you need a new card.
Fake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourselfSecurity firm Flashpoint says criminals are trading in refund tricks, gift card fraud and hacked online stores ahead of the holidays. Shop owners should check their refund steps.
Read more: Scammers are targeting store refunds and gift cards before the holidaysThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone calls
