Costco costco.com Costco data breach: what happened and what to do
Costco's online photo center was breached through vendor PNI Digital Media. Reports say the card details of a small percentage of members were taken between mid-2014 and mid-2015.
View all 13,177 breaches- Breach date
- 19 Jun 2014
- Made public
- 22 Sept 2015
- Data exposed
- Credit cards, Physical addresses
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Costco's online photo center was hit through a vendor, PNI Digital Media, which ran photo ordering for several retailers. Costco's notice is listed with the Washington Attorney General's office, with a June 19, 2014 start date.
What happened
Reports at the time say the compromise ran from mid-2014 into mid-2015. Photos weren't taken. Costco said the credit card information of a small percentage of members was. CVS and Rite Aid were hit too, and several retailers pulled their photo services for weeks.
Sources checked: atg.wa.gov, geekwire.com, securityledger.com
Last verified against the official page:
What was exposed
Members who typed a card number into the photo site could have lost the number, the expiration date and the security code. Mail orders may also have exposed a mailing address. Stolen card details get used for fraudulent purchases. An address makes a phishing message about "your photo order" look believable.
What this means for you
Costco hasn't published a total, and Washington's count covers that state only. A class settlement covered CVS, Costco and Rite Aid photo customers. Its claim deadline was 14 December 2017, so there is nothing left to file. If you used the site in that period, watching your card statements and being skeptical of photo-order emails is the practical step.
What to do if you were in it
- 1
Check card statements and replace the card
If you used a card on Costco's photo site in that period, look for charges you don't recognize and ask your card issuer about a replacement.
- 2
Freeze your credit if your identity details were involved
A credit freeze at Equifax, Experian and TransUnion is free and stops new accounts being opened in your name. The FTC explains how to place one.
- 3
Report misuse at IdentityTheft.gov
If you see accounts or charges you don't recognize, the FTC's IdentityTheft.gov builds a recovery plan and walks you through reporting it.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see where your details have turned up, and get alerts if they appear in new breaches.
Official filings
- Washington Attorney General , filed 22 Sept 2015 : 29,425 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the Costco data breach?
Costco said a small percentage of members who paid on its online photo site were affected.
What was exposed?
Card numbers, expiration dates and security codes for some members, and mailing addresses for some mail orders, according to news reports of Costco's notice.
Is there a settlement?
A class settlement covered CVS, Costco and Rite Aid photo customers, and its claim deadline was 14 December 2017.
Sources
- atg.wa.gov/data-breach-notifications
- geekwire.com/2015/costco-photo-center-finally-back-online-after-security-breach-forces-seven-week-outage/
- securityledger.com/2015/09/photo-bombed-retailers-cvs-and-costco-admit-customer-data-stolen-in-third-party-breach/
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
