Filters Fast filtersfast.com Filters Fast data breach: what happened and what to do
Attackers skimmed checkout data on the Filters Fast website for purchases made between July 16, 2019 and July 10, 2020, according to the New York Attorney General. The data included names, billing addresses, card expiration dates and security codes.
View all 13,177 breaches- Breach date
- 16 Jul 2019
- Data exposed
- Names, Physical addresses, Credit cards
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Filters Fast, LLC sells water and air filters online. The New York Attorney General says its website was compromised through a vulnerability in a plugin, and attackers skimmed payment details from customers who bought on the site between July 16, 2019 and July 10, 2020. A payment system management company flagged the site on February 25, 2020, but the company's first internal review found no breach. An outside forensic investigator found the plugin vulnerability in late July 2020.
Sources checked: ag.ny.gov, hunton.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
The skimmed data included cardholders' names, billing addresses, card expiration dates and security codes, which is everything needed for an online card payment.
How many people
Counts differ by source and filing. The New York Attorney General's announcement describes about 16,500 New Yorkers, and state filings are state-by-state. No single total is used on this page.
What it means for you
A stolen card number with its security code can be used for online purchases until the card is replaced. Billing addresses also make phishing about an order or refund more believable. Card data alone doesn't give anyone your Social Security number, so a credit freeze is optional here.
The regulator's action
In 2021 the New York Attorney General announced a $200,000 agreement with Filters Fast, with part suspended, and required the company to set up an information security program.
What to do if you were in it
- 1
Ask your bank for a new card
If you bought from Filters Fast in that window, call the number on your card and ask for a replacement. The old number and security code are the ones that were skimmed.
- 2
Check statements and dispute charges
Look back through your statements and dispute anything you don't recognize with your card issuer, promptly.
- 3
Consider a free credit freeze
A card breach alone doesn't expose your Social Security number, but a freeze costs nothing and blocks new accounts in your name. See the FTC guidance.
- 4
Treat messages that mention the breach as suspect
Scammers quote real breach details to look legitimate. Don't click links or call numbers in unexpected messages. Go to the company's website yourself, and see the FTC's phishing guide.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details turn up, so you know when to repeat these steps.
Official filings
- Washington Attorney General , filed 14 Aug 2020 : 6,584 people
Timeline
-
The breach happened
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the Filters Fast breach?
If you paid by card on the Filters Fast site between July 16, 2019 and July 10, 2020, your details may have been skimmed. Filters Fast notified affected customers.
What was exposed?
Names, billing addresses, card expiration dates and security codes, per the New York Attorney General.
Was there a settlement?
The New York Attorney General announced a $200,000 agreement with the company in 2021. That is with the state, not a payout to customers.
Should I get a new card?
Yes, if you used one on the site in that period. Ask your card issuer for a replacement.
Sources
- ag.ny.gov/press-release/2021/attorney-general-james-announces-agreement-filters-fast-after-2019-data-breach
- hunton.com/privacy-and-cybersecurity-law-blog/2021/05/20/new-york-ag-settles-with-filters-fast-after-data-breach/
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
- consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams
Something wrong or out of date? Tell us and we'll re-check it.
