Story image

Kathmandu breached, customer information accessed

14 Mar 2019

Outdoor equipment retailer Kathmandu has suffered a data breach which gave a third party access to customer information for a month.

In a statement on its investor relations site, Kathmandu says it is urgently investigating a security incident with its online trading websites.

Kathmandu recently became aware that between January 8, 2019, and February 12, 2019, an unidentified third party gained unauthorised access to the Kathmandu website platform.

During this period, the third party may have captured customer personal information and payment details entered at checkout.

The personal information which could have been impacted by the incident may include some or all of the following categories of information (if provided by customers):

  • billing and shipping name, address, email and phone number;

  • the credit/debit card details provided to complete the purchase;

  • Kathmandu Summit Club username and password;

  • special instructions relating to an order (including pick up/delivery details); and

  • any gift card details.

Kathmandu says it took immediate steps to confirm that the Kathmandu online store is and remains secure.

The wider IT environment including all Kathmandu physical stores were not impacted by the incident.

Since then, Kathmandu has been working closely with leading external IT and cybersecurity consultants to fully investigate the circumstances of the incident and confirm which customers may have been impacted.

Kathmandu is notifying potentially affected customers directly.

It has also notified the relevant authorities, including the Information Commissioner's Office in the UK, the Office of the Australian Information Commissioner, the New Zealand Privacy Commissioner and reported the incident to the Australian Cyber Crime Online Reporting Network and the New Zealand Police.

In a statement on its website, Kathmandu said that it’s also working alongside agencies and regulators in other jurisdictions.

Kathmandu advised any customer who believes they may have been impacted to contact their banks or credit card providers and follow their recommended advice.

“If you used an Australian issued Visa, Visa Debit or Mastercard on our site between January 8, 2019 and February 12, 2019, Visa and Mastercard may have taken steps to block your card and have it reissued. If your card has not been reissued, contact your bank for more information as soon as possible.

“If you used another credit or debit card on our site between 8 January 2019 and 12 February 2019, we recommend that you review and continue to monitor your financial and payment card account statements for any discrepancies or unusual activity. Contact your financial institution if you have any concerns.”

Kathmandu chief executive officer Xavier Simonet says, “Whilst the independent forensic investigation is ongoing, we are notifying customers and relevant authorities as soon as practicable.

“Kathmandu takes the privacy of customer data extremely seriously and we unreservedly apologise to any customers who may have been impacted.”

Why 'right to repair' legislation could be a new lease on life for broken devices
“These companies are profiting at the expense of our environment and our pocketbooks as we become a throw-away society that discards over 6 million tonnes of electronics every year.”
Attacks targeting Cisco Webex extension explode in popularity - WatchGuard
WatchGuard's Internet Security Report for Q4 2018 also finds growing use of a new sextortion phishing malware customised to individual victims.
SAS partners with NVIDIA on deep learning and computer vision
“By partnering with NVIDIA, we combine our strengths to augment human intelligence and realise the true potential of AI.” 
Why businesses must embrace automation to ensure success
“For many younger workers, the traditional view of a steady job at one company, perhaps for life, simply doesn’t reflect reality."
Dropbox invests in hosting data inside Australia
Global collaboration platform Dropbox has announced it will now host Australian customer files onshore to support its growing base in the country.
TYAN unveils new inference-optimised GPU platforms with NVIDIA T4 accelerators
“TYAN servers with NVIDIA T4 GPUs are designed to excel at all accelerated workloads, including machine learning, deep learning, and virtual desktops.”
Worldwide spending on security to reach $103.1bil in 2019 - IDC
Managed security services will be the largest technology category in 2019.
How Cognata and NVIDIA enable autonomous vehicle simulation
“Cognata and NVIDIA are creating a robust solution that will efficiently and safely accelerate autonomous vehicles’ market entry."