Seiko USA Site Defaced With Unverified Shopify Customer-Data Theft Claim
Summary
A defaced Seiko USA page claimed attackers accessed its Shopify backend and stole customer data, threatening publication after 72 hours. The actor and claims remain unverified; Seiko has not publicly confirmed the incident and removed the message.
Key points
- A page titled “HACKED” appeared in the Press Lounge section of Seiko USA’s website with an extortion message.
- The attackers claimed they accessed Seiko USA’s Shopify backend and exfiltrated its customer database; this claim has not been verified.
- The alleged data included names, contact details, order history, shipping information and account details.
- The message demanded contact within 72 hours and threatened to publish the alleged data.
- BleepingComputer could not identify the threat actor; Seiko USA has not publicly confirmed the incident and removed the message.
Article Details
- Victim Organization
- Seiko USA
- Incident Type
- Website defacement with an extortion message and an unverified claim of customer database theft.
- Data Types Exposed
- Allegedly names, email addresses, and phone numbers
- Allegedly purchase records and transaction details
- Allegedly shipping addresses and preferences
- Allegedly account creation dates and customer notes
- Affected Records
- Unknown; attackers claimed the entire customer database was accessed, but no record count was provided and the claim was unverified.
- Affected Data Size
- Unknown; attackers claimed the entire customer database was exfiltrated, but this was not verified.
- Operational Impact
- The site's Press Lounge section displayed a defacement and extortion message in place of normal content. Seiko USA later removed the message.
- Ransom Or Extortion
- The attackers threatened to publish the allegedly stolen database unless Seiko USA negotiated, setting a 72-hour deadline. No ransom amount was stated.
- Claim Status
- claimed