Staples staples.com Staples data breach 2014: what happened and what to do
Malware on checkout systems at 115 Staples stores stole payment card data between August and September 2014. Staples put the number at about 1.16 million cards and said names, card numbers, expiry dates and verification codes were exposed. It disclosed the breach on December 19, 2014.
View all 13,115 breaches- Breach date
- 10 Aug 2014
- Made public
- 19 Dec 2014
- Data exposed
- Names, Credit cards
- Last updated
What happened
Staples disclosed on December 19, 2014 that criminals had put malware on the point-of-sale systems at 115 of its more than 1,400 US stores. At most stores the malware ran from August 10 to September 16, 2014. At two stores, in Pennsylvania and New Jersey, it started earlier, on July 20. Staples said it removed the malware in mid-September and added new encryption to its checkout systems.
The company estimated that about 1.16 million payment cards were potentially exposed. Press coverage of the notice says the stolen fields were the cardholder's name, card number, expiry date and card verification code. That's enough to make a counterfeit card or to pay online where a shop doesn't ask for more.
Staples also looked into reports of fraudulent card use at four Manhattan stores between April and September 2014. It found no malware or suspicious activity on the payment systems there.
The breach was reported to the California Attorney General, which lists it with a notice date in December 2014. Staples offered affected customers free credit monitoring, identity theft insurance and a free credit report.
The breach is more than a decade old, so the cards involved have almost certainly expired or been replaced. It still matters if you used the same card for years, or if your name and card details turned up elsewhere. Card data can't be recalled once it's stolen, which is why the fix is a new card number, not a new password.
What to do if you were in it
- 1
Check your card statements
Look at every charge from the affected period and report anything you don't recognize to your bank. Most card issuers cap your liability for fraud if you report it quickly.
- 2
Ask for a new card if you used one
If you paid with a card during the affected window, ask your issuer to replace it. Card numbers, expiry dates and security codes can't be changed any other way.
- 3
Turn on transaction alerts
Set up text or app alerts for every purchase so fraud shows up in minutes, not on next month's statement.
- 4
Expect phishing that mentions the breach
Emails and texts that offer help with the breach are a common scam. Go to the company's website yourself instead of clicking links.
- 5
Check whether your email or phone is in other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details appear in a new leak.
Frequently asked
Was I affected by the Staples data breach?
Only if you paid with a card at one of the 115 affected stores during the affected window, mostly August 10 to September 16, 2014.
What data was exposed?
Cardholder names, card numbers, expiry dates and card verification codes, according to press coverage of Staples' notice.
Should I change my password?
Not because of this breach. Passwords weren't reported as exposed. Replace the card if you still use one from that period.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
