The personal information of thousands of users of the grocery delivery service Instacart is being sold on the Dark Web for around $2 per customer.
This data includes the names, last four digits of credit card numbers and order histories of the service's users and even customers who used the service recently, according to a report from BuzzFeed News.
As of last Wednesday, sellers in two Dark Web stores were selling user information from what appears to be 278,531 accounts. However, some of these accounts could be duplicates or not genuine. Instacart has millions of customers across the US and Canada as of April of this year as more people turn to having their groceries delivered to avoid going into supermarkets during the pandemic.
- Create strong passwords with one of the best password generators
- Store your passwords in one place securely with the best password manager
- Also check out our guide to the best VPN services on the market
Not a data breach
In a security update published on its website, Instacart explained that credential stuffing was likely to blame and that its platform had not been compromised or breached, saying:
“Our teams have been working around the clock to quickly determine the validity of reports related to site security and so far our investigation has shown that the Instacart platform was not compromised or breached. Based on our team’s assessment, we believe that this is what is commonly referred to as credential stuffing — an activity that occurs across the web when a person uses the same login credentials across various websites and apps.”
Credential stuffing is a tactic often employed by cybercriminals who use usernames and passwords from past data breaches to try and gain access to users' accounts on other services. However, it seems plausible that hundreds of thousands of Instacart customers used the same passwords across multiple sites.
To protect its users, Instacart is notifying affected customers, invalidating their previous passwords and advising them to reset their password as an extra security measure.
- We've also highlighted the best ecommerce platforms around
Via BuzzFeed News
