Tennis Warehouse tennis-warehouse.com Tennis Warehouse data breach: what happened and what to do
Attackers got into the systems behind Tennis Warehouse and its sister sites on October 1, 2021. The New York Attorney General says card details of up to 1,813,224 shoppers and login credentials of 1,180,939 were potentially accessed. Notices started on December 16, 2021.
View all 13,177 breaches- Breach date
- Oct 2021
- Data exposed
- Credit cards, Login credentials
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Tennis Warehouse, LLC is one of several online sports retailers run by a shared parent, Sports Warehouse, alongside Tackle Warehouse, Running Warehouse and Skate Warehouse. Attackers got into their systems on October 1, 2021, and the companies found it in mid-October. The breach was reported to the California Attorney General in 2022 and to Maine's on December 16, 2021, when notices to affected shoppers started.
According to the New York Attorney General, the attackers potentially accessed non-expired payment card information of as many as 1,813,224 shoppers across the group's sites, including 101,558 New Yorkers, and the login credentials of 1,180,939 shoppers.
Sources checked: oag.ca.gov, ag.ny.gov, bitdefender.com.au
Last verified against the official page:
What was exposed
Press coverage of the incident reports card numbers and security codes, and account login credentials. With a card number and security code, someone can make purchases online until the card is replaced. Login credentials are a risk on any other site where you reused the same password.
The outcome
The New York Attorney General found the companies hadn't taken reasonable steps to protect shoppers' data, including not encrypting private information on their servers. In 2023 the companies agreed to pay $300,000 and to overhaul their security program.
What to do if you were in it
- 1
Replace any card you used there
Ask your bank or card issuer for a new card number if you paid at one of these stores in 2021, and check statements for charges you don't recognize. The FTC advises contacting your card issuer if card details were exposed.
- 2
Change your password, and every reuse of it
Change the password on the retailer's site, then on any other account where you used the same or a similar one. A password manager makes unique passwords easy.
- 3
Turn on two-factor login
Use an authenticator app or passkey where a site offers it.
- 4
Expect phishing that mentions the breach
Don't click links in messages about your order or account. Go to the retailer's site yourself.
- 5
Report misuse
If someone uses your details, report it at IdentityTheft.gov.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak.
Official filings
- California Attorney General , filed 12 Apr 2022
- Washington Attorney General , filed 17 Dec 2021 : 18,228 people
Timeline
-
The breach happened
-
Reported to the Washington Attorney General
-
Reported to the California Attorney General
Frequently asked
Was I affected by the Tennis Warehouse data breach?
The companies sent notices from December 16, 2021 to shoppers whose card details were affected, with login-credential notices following. If you shopped on one of the group's sites in 2021 and got nothing, contact the retailer directly.
What was exposed?
The New York Attorney General says payment card information and login credentials were potentially accessed. Press coverage reports card numbers and security codes.
Was there a settlement?
The New York Attorney General reached a $300,000 settlement with the companies in 2023 and required a security overhaul. Reports don't describe payouts to shoppers.
Should I change my password?
Yes, if you had an account. Change it on the retailer's site and anywhere you reused it.
Sources
- oag.ca.gov/privacy/databreach/list
- ag.ny.gov/press-release/2023/attorney-general-james-secures-300000-online-sporting-goods-retailers-failing
- bitdefender.com.au/blog/hotforsecurity/hackers-steal-credit-cards-from-1-8-million-sports-gear-site-customers/
- consumer.ftc.gov/articles/what-do-if-there-was-data-breach
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
