Warner Music Group wmg.com Warner Music Group data breach: what to do
Attackers skimmed details from Warner Music Group's online stores between April 25 and August 5, 2020. Exposed data included names, contact details, billing and shipping addresses, and card numbers with expiry dates and security codes. Warner hasn't published a total.
View all 13,177 breaches- Breach date
- 25 Apr 2020
- Data exposed
- Names, Email addresses, Phone numbers, Physical addresses, Credit cards
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Warner Music Group (WMG) told customers in 2020 that attackers had put code on several of its US online stores. The stores were run for WMG by a third-party service provider. Reports of the notice say the code captured what shoppers typed into the sites between April 25 and August 5, 2020. Security press compared it to a Magecart-style skimming attack, though that label is an outside assessment, not WMG's.
What was exposed
According to coverage of the notice, the data included names, email addresses, phone numbers, billing and shipping addresses, and payment card numbers with expiry dates and security codes. Payments through PayPal were reportedly not affected.
The Washington Attorney General's list shows 3,368 Washington residents notified, and the California AG's list also carries the incident. Those are state counts, not a total, and Warner hasn't published one.
What it means for you
Card details typed into a skimmed checkout can be used for fraudulent purchases. The contact details also help scammers write messages that sound like they come from Warner or your bank. Card fraud is the most likely harm here, and it's the easiest to limit: a replaced card number stops the old one working.
WMG offered affected customers 12 months of identity monitoring. A class action followed. If you bought from a WMG store online in that window and never got a letter, look back at your card statements for that period.
Sources checked: infosecurity-magazine.com, digitalmusicnews.com, oag.ca.gov
Last verified against the official page:
What to do if you were in it
- 1
Replace the card you used
If you paid by card at a WMG store between April and August 2020, ask your issuer for a new card number and check old statements for charges you don't recognize. Federal rules limit what you owe for fraudulent card charges you report promptly.
- 2
Expect messages that mention the breach
Criminals use your name, address and recent purchase to make scam emails, texts and calls sound real. Don't click links or call numbers in them. Go to the company's own site, or call the number on your card or statement.
- 3
Take the free monitoring if you got an offer
If your notice letter included identity monitoring, the FTC says to use it. Sign up with the details in your letter, not a link from an email.
- 4
Report misuse
If someone opens accounts or files claims in your name, report it at IdentityTheft.gov, the FTC's reporting site, which gives you a recovery plan.
Official filings
- Washington Attorney General , filed 2 Sept 2020 : 3,368 people
Timeline
-
The breach happened
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the Warner Music Group breach?
If you bought from a WMG US online store between April 25 and August 5, 2020, your details may have been captured. Check for a notice letter and review card statements from then.
What was exposed?
Names, email addresses, phone numbers, billing and shipping addresses, and card numbers with expiry dates and security codes, per coverage of WMG's notice.
How many people were affected?
Warner hasn't published a total. Washington's list shows 3,368 residents of that state, which is only part of the picture.
Should I change my password?
The coverage doesn't say account passwords were taken. Replacing the card matters more.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
