A data breach at the Weee! Asian and Hispanic meal delivery business exposed the private data of 1.1 million clients. Weee! bills itself as the most prominent Asian and Hispanic supermarket in North America, shipping groceries to all 48 states via its network of warehouses.
On Monday, a threat actor named “IntelBroker” started leaking information for Weee! on the Breached hacking forum. The forum post states, “In February 2023, hackers obtained a database of the Sayweee’s 11 million subscribers.”
Customers’ first and last names, email addresses, phone numbers, device type (iOS, PC, Android), purchase notes, and other information used by the delivery platform are all included in the stolen database for Weee!
The company boasts its delivery app was downloaded over 2.6 million times. According to data on the Google Play store, Weee! Asian Grocery Delivery app has been downloaded over 500k times. The full statement from Weee! “We recently became aware of a data compromise that has affected some customer information.
“Weee! does not store any consumer payment information in our systems, so we can ensure that no customer payment information is exposed. Customers’ names, addresses, emails, phone numbers, and order comments may have been impacted if they made a request between July 12, 2021, and July 12, 2022.
“We have informed every client of the problem and will contact every affected consumer directly if their information was exposed,” the company said.
“Security is very paramount for us, and we are doing a careful examination to ensure we can uphold the confidence the Weee! Community has placed in us,” the company stated.
Weee! emphasizes that, despite this, the payment information was kept a secret because they do not save it in their database.
Troy Hunt of the data breach known as “Have I Been Pwned” notice service said that the exposed data only has 1.1 million unique email addresses, despite the threat actor’s claim that it comprises 11 million customers.
The repeated orders from the same consumer are probably what resulted in the extra entries. You can later today, after the data is added, look for your email address on Have I Been Pwned to see if your information was compromised in this hack.
Existing subscribers to the notification service will automatically receive an email notifying them of the data breach as soon as it is added to Have I Been Pwned.
6 Ways That Hackers Attack Retail Stores
Retail store hacking is not a recent phenomenon; however, it has become more common in recent years. In fact, retailers lost more money to cybersecurity assaults in 2019 than any other business, totaling over $30 billion.
1. Web skimming
Online skimmers smuggle malware into website source codes to steal clients’ personal information. For making purchases, all e-commerce websites have a payment page, the majority of which are safely encrypted. However, web skimmers prioritize those who need complete security. This virus is a favorite of threat actors since it is difficult to detect, especially for small firms without sophisticated technology, and it can impact hundreds of clients at once.
Skimmers access websites via an outside source, like a plug-in or an e-commerce page. Because they frequently have weaker code structures, these entryways are simpler to penetrate. (First-party entry often only affects those modest sites needing robust cybersecurity safeguards.) Passwords, social security numbers, and credit card numbers are sent back to the servers of the fraudsters once the script has infected the homepage.
2. Near field communication (NFC)
Targets for NFC intrusions include price scanners, mobile devices, and card readers. Customers can utilize NFC technology to buy products by tapping their phones against a reader.
Similarly to this, someone can scan a QR code to open a premium app or arrive at a website where they can make purchases. Although NFC is practical, retail hackers need help intercepting and stealing data from its transactions.
Infected phones can transmit malware to retail systems. Face-to-face transactions frequently use NFC technology, but more websites also include QR codes for customers to scan. Hackers typically employ a variety of techniques to tamper with data sent across a distance, including:
3. Credentials stuffing
Because it’s one of the simplest ways to steal data, retail hackers regularly utilize credential stuffing or stolen usernames and passwords to enter networks. Hackers purchase these credentials on the dark web or from databases of personally identifiable information posted online following significant data breaches, then use them to access shops’ websites and make purchases. Since many people use the same passwords on numerous websites, they are vulnerable to intrusion.
4. Card readers
Due to their magnetic strips, credit and debit cards are frequently the subjects of cybersecurity attacks. Hackers can get information from a single card swipe rather than always trying to brute force their way into internet accounts. PINs and card numbers are among the card data that is kept encrypted up until the point of the swipe. Skilled hackers may seize this chance to steal the data, exploit it for their own benefit, or sell it to others.
5. Social engineering
Although “social engineering” may seem too difficult to be accurate, it is one of the oldest criminal techniques and is effective at influencing people’s emotions. In the days before the Internet, someone may dress up as a department store employee and claim to work there in order to acquire confidential information. Knowing that some overwhelmed workers may readily provide the information they request so they can get back to work, they may approach other employees for assistance. Others might hang out in front of a store and use the age-
6. RAM scraping
Hackers utilize the RAM scraping technique to access point-of-sale systems. Each card transaction leaves data in the terminal system of the business. By scraping the data kept on a card’s traces, including the account number, CVN, and expiration date, they can get it. Threat actors can install POS malware that reads this input before it vanishes, even if this information only lasts momentarily while it is stored in the machine’s RAM.
Conclusion
A data breach that made the private information of 1.1 million clients of the Asian and Hispanic supermarket delivery business The Weee!. It advertises itself as the most prominent Asian and Hispanic supermarket in North America, distributing goods to all 48 US states from warehouses spread out over the nation. A threat actor named IntelBroker started gathering information for Weee! on Monday in the Breached Hacking and Data Breach Forum. The forum post claims that hackers took a database of Sayweee’s 11 million consumers in February 2023. The stolen database includes Weee! users’ first and last names, email addresses, phone numbers, device types (iOS, PC, Android), order notes, and other information the delivery platform needs. Weee! confirmed that client information was stolen in the data breach after getting in touch with them regarding the incident.
