Zulily zulily.com Zulily data breach: what happened and what to do
Between February 23 and June 15, 2022, a code problem on Zulily's checkout page sent some customers' email address, card number, security code and expiration date to a second payment processor that wasn't authorized to handle Zulily's payments.
View all 13,177 breaches- Breach date
- 23 Feb 2022
- Made public
- 22 Jul 2022
- Data exposed
- Email addresses, Credit cards
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Zulily's notice to customers describes a checkout bug, not a break-in. Between February 23, 2022 and June 15, 2022, code on the Zulily website sent transaction details for some purchases to two payment card processors instead of one. Both are legitimate processors, but the second one was not authorized to process payments for Zulily. Zulily disabled the code on June 15, 2022.
What was exposed
Zulily says it determined on June 26, 2022 that the second processor received each affected customer's email address, payment card number, card verification code and expiration date. That is everything a thief needs to make an online purchase with the card. The notice does not say the data was stolen or misused, and it doesn't give a total number of people affected.
Some customers were also charged shipping and handling twice by the second processor. Zulily said it was refunding those charges.
What Zulily did
Zulily fixed the code, told the payment processors, and mailed notice letters to affected customers. The sample letter filed with the California Attorney General is dated July 2022. The letter lists the three credit bureaus and the FTC's identity theft site for customers who want to take further steps.
What it means for you
A card number with its security code can be used for fraudulent purchases until the card is replaced. Because your email address was in the same data, a message that mentions your Zulily order or a "problem with your payment" could be a phishing attempt. If you shopped on Zulily in that window and got a letter, take it seriously. If you shopped then and didn't get one, the letter is the only way Zulily says it identified affected customers, so you may not have been in the group.
Sources checked: oag.ca.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What to do if you were in it
- 1
Call your card issuer
If you paid by card on Zulily between February 23 and June 15, 2022, ask your bank or card company to replace the card. The number and security code were both involved.
- 2
Review your statements
Look for charges you don't recognize, including small test charges, and report them to your card issuer right away. Check for the duplicate shipping fee Zulily said it would refund.
- 3
Expect phishing about your order
Your email address was part of the data. Don't click links in messages about Zulily orders or payment problems; go to the site directly. The FTC explains how to spot phishing: https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams
- 4
Know where to report identity theft
If someone misuses your information, report it at https://www.identitytheft.gov and follow the recovery plan it gives you.
- 5
Check whether your email or phone number shows up in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears, so you know what to watch for.
Official filings
- California Attorney General , filed 22 Jul 2022
Timeline
-
The breach happened
-
The company made it public
-
Reported to the California Attorney General
Frequently asked
Was I affected by the Zulily data breach?
Zulily mailed notice letters to affected customers in July 2022. If you paid by card on its website between February 23 and June 15, 2022 and got a letter, you were affected. The notice does not say how many people that was.
What information was involved?
Your email address, payment card number, card verification code and expiration date.
Was Zulily hacked?
Zulily's notice describes an issue with the code running its checkout page, which sent transaction data to a second payment processor. It does not describe an outside attacker.
Should I replace my card?
If it was used on Zulily during that period, asking your card issuer for a new one is a reasonable step, since the number and security code were both involved.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
