Anybody who has made a purchase from MyFreedomSmokes in the past few months needs to consider closing your credit card. Perhaps other vendors use this same payment processor. It looks like the bad guys got away with all the info, including card numbers as well as the 3 digit card verification numbers, for a considerable period of time.
This is the email I received:
=======================================
May 26, 2017
Dear Customer,
My Freedom Smokes recently became aware of a potential security incident that may have affected the personal information of individuals who made purchases on myfreedomsmokes.com. We are providing this notice as a precaution to let you know about the incident and to call your attention to some steps you can take to protect yourself. We sincerely regret any concern this may cause you.
What Happened
Although the incident is still under investigation, it appears that between approximately March 7, 2017 and April 25, 2017, an unauthorized individual was able to obtain access to portions of our website and insert malicious code that was designed to capture payment information provided in connection with a purchase.
What Information Was Involved
We believe that the incident could have affected certain information (including name, address, email address, telephone number, payment card account number, expiration date, and card verification value (CVV) of individuals who made a purchase on the website. According to our records, you made a purchase using a payment card during the relevant period and your information may be affected. Please note that because we do not collect sensitive information like Social Security numbers for standard payment card transactions, this type of sensitive information was not affected by this incident.
How We Are Responding
My Freedom Smokes takes the privacy of its customers very seriously, and we deeply regret that this incident occurred. We took steps to address and contain the incident promptly after it was discovered, including an internal investigation into the incident and communicating with the vendor who hosts and operates our website to learn more about what occurred. Further, we have retained an internationally recognized cyber security and digital data forensics firm to assist us in identifying the problem, fixing it, and preventing it from happening again. Also, note that well before this incident My Freedom Smokes moved to a tokenization system to better protect customer information.
What Can I Do
We do not believe that exposure of your payment card number is likely to result in identity theft. We recommend that you review payment card account statements promptly and carefully in order to identify any discrepancies or unusual activity. If you see any suspicious activity, you should immediately notify the issuer of the payment card and, if warranted, to law enforcement or regulatory authorities.
We are including with this letter an attachment listing additional steps you may wish to consider taking if you ever suspect that you may be the victim of identity theft. We are providing this information out of an abundance of caution, even though a loss of payment card information can only result in fraudulent charges, for which you would not be liable.
We take the security of your information very seriously, and we regret any inconvenience or concern this incident may cause you. If you have any questions or concerns about this incident, please do not hesitate to contact us at 1-800-955-9753 at any time of the day or night.
Sincerely,
Joe Joyal
Freedom Smokes, Inc.
This is the email I received:
=======================================
May 26, 2017
Dear Customer,
My Freedom Smokes recently became aware of a potential security incident that may have affected the personal information of individuals who made purchases on myfreedomsmokes.com. We are providing this notice as a precaution to let you know about the incident and to call your attention to some steps you can take to protect yourself. We sincerely regret any concern this may cause you.
What Happened
Although the incident is still under investigation, it appears that between approximately March 7, 2017 and April 25, 2017, an unauthorized individual was able to obtain access to portions of our website and insert malicious code that was designed to capture payment information provided in connection with a purchase.
What Information Was Involved
We believe that the incident could have affected certain information (including name, address, email address, telephone number, payment card account number, expiration date, and card verification value (CVV) of individuals who made a purchase on the website. According to our records, you made a purchase using a payment card during the relevant period and your information may be affected. Please note that because we do not collect sensitive information like Social Security numbers for standard payment card transactions, this type of sensitive information was not affected by this incident.
How We Are Responding
My Freedom Smokes takes the privacy of its customers very seriously, and we deeply regret that this incident occurred. We took steps to address and contain the incident promptly after it was discovered, including an internal investigation into the incident and communicating with the vendor who hosts and operates our website to learn more about what occurred. Further, we have retained an internationally recognized cyber security and digital data forensics firm to assist us in identifying the problem, fixing it, and preventing it from happening again. Also, note that well before this incident My Freedom Smokes moved to a tokenization system to better protect customer information.
What Can I Do
We do not believe that exposure of your payment card number is likely to result in identity theft. We recommend that you review payment card account statements promptly and carefully in order to identify any discrepancies or unusual activity. If you see any suspicious activity, you should immediately notify the issuer of the payment card and, if warranted, to law enforcement or regulatory authorities.
We are including with this letter an attachment listing additional steps you may wish to consider taking if you ever suspect that you may be the victim of identity theft. We are providing this information out of an abundance of caution, even though a loss of payment card information can only result in fraudulent charges, for which you would not be liable.
We take the security of your information very seriously, and we regret any inconvenience or concern this incident may cause you. If you have any questions or concerns about this incident, please do not hesitate to contact us at 1-800-955-9753 at any time of the day or night.
Sincerely,
Joe Joyal
Freedom Smokes, Inc.
