Newegg newegg.com Newegg data breach: what happened and what to do
Newegg said on September 19, 2018 that card details of some customers were stolen at checkout. Researchers say the skimming script ran from August 14 to September 18, 2018. Newegg hasn't published a total number of people affected.
View all 13,177 breaches- Breach date
- 14 Aug 2018
- Made public
- 19 Sept 2018
- Data exposed
- Names, Credit cards
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
On September 19, 2018, Newegg announced that its website had been breached and that customers' payment card details were compromised. Security researchers at Volexity and RiskIQ traced it to a Magecart-style skimmer: a short piece of JavaScript injected into the checkout page on secure.newegg.com. It copied card details as customers typed them and sent them to a look-alike domain, neweggstats.com. Researchers said the script was live from August 14 to September 18, 2018, and that it affected desktop and mobile checkout.
Newegg hasn't published how many customers were affected, so we don't state a figure. A residents-of-one-state count appears in the state Attorney General notification listings, but it is not a total.
Sources checked: thehackernews.com, androidcentral.com, identitytheft.gov
Last verified against the official page:
What was exposed
The script captured whatever was entered at checkout, which means payment card details. Anyone who paid by card on Newegg in that window should assume the card was exposed.
What that means for you
Stolen card numbers are used for fraudulent purchases or sold on. A card breach by itself doesn't give criminals your Social Security number, but expect scam messages that mention Newegg or a refund.
What to do if you were in it
- 1
Contact your bank or card issuer
If you paid by card on Newegg between August 14 and September 18, 2018, ask your issuer to block the card and send a replacement.
- 2
Check statements for charges you don't recognize
Report fraudulent charges to your card issuer quickly, then report identity theft at IdentityTheft.gov if someone opened accounts in your name.
- 3
Be careful with messages about the breach
Expect emails or texts about Newegg orders or refunds. Don't click links; go to the site yourself.
- 4
Check whether your email or phone is in this and other breaches
A free Serus scan checks breach databases for your email and phone and shows what else is out there.
Official filings
- Washington Attorney General , filed 15 Nov 2018 : 5,931 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the Newegg breach?
If you entered a payment card on Newegg checkout between August 14 and September 18, 2018, researchers say it may have been captured.
How many people were affected?
Newegg hasn't published a total.
Should I change my password?
The reports describe stolen card details, not passwords. Changing a password you reuse is still good practice, and the card is the priority.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
