American online retailer Bodybuilding.com suffered a security incident that might have exposed customers’ personal information.

In February 2019, Bodybuilding.com learned of an instance where unknown actors gained unauthorized access to its systems. The fitness platform responded by retaining a data forensics firm to investigate what happened. This effort, which concluded in April 2019, traced the unauthorized access back to a phishing email received in July 2018. It also failed to rule out the possibility that the attack exposed customers’ personal information including their name, email address, phone number and birthdate.

The investigation did determine, however, that the security event left customers’ payment card information untouched.

Given these findings, Bodybuilding.com decided to reset all users’ passwords and to provide users with information about how they can protect their data. Additionally, it said that it will continue to work with law enforcement authorities to monitor for suspicious activity on its site and to improve the security of its systems. As quoted in a statement published on its website:

We sincerely regret any inconvenience or concern caused by this incident. We are committed to protecting your information and maintaining your trust and confidence.

This isn’t the first time that Bodybuilding.com has suffered a security event. Back in 2008, a user of the site found that they could upload and host HTML files with JavaScript links using the blog’s upload feature. By abusing that weakness, the user said they could potentially modify or delete other users’ body stats.

The platform plugged that particular weakness three days after it was disclosed.

Regarding this latest security incident, users of Bodybuilding.com can protect themselves by using this expert guidance to create a strong password for their accounts. They should also exercise caution around suspicious links and email attachments. Towards that end, (Read more...)