In a disturbing breach, cybercriminals successfully siphoned credit card details from over 100,000 individuals after compromising parts of the Oregon Zoo’s website.
The Portland-based zoo recently disclosed to regulators that it had been the target of a months-long cyberattack aimed at its payment platform. This breach highlights the increasing vulnerability of online systems, even those belonging to well-established institutions like zoos.
The suspicious activity was first detected in late June when zoo officials noticed irregularities within their online ticketing service. Promptly, the website was taken offline for a thorough investigation.
By July 22, the investigation revealed that an “unauthorized actor” had rerouted customers’ transactions from the zoo’s third-party payment processor, potentially capturing sensitive payment information between December 20, 2023, and June 26, 2024.
In a statement, the Oregon Zoo emphasized their precautionary measures, stating, “As a precaution, Oregon Zoo reviewed all transactions from this period to identify anyone whose payment card information may have been affected.” The compromised data included customers’ names, payment card numbers, CVV codes, and expiration dates.
The zoo reported that 117,815 individuals were affected by this breach. In response, federal law enforcement agencies were notified, and the zoo is offering one year of credit monitoring services to those impacted.
The breach was also reported to regulatory bodies in Oregon and Texas. This incident follows similar attacks on other major zoological organizations, including the Toronto Zoo and Tampa Bay Zoo, over the past year.
The use of payment-skimming malware has been a long-standing tactic for cybercriminals to illicitly gather credit card information from e-commerce platforms. In such attacks, hackers insert malware or skimming tools into websites, enabling them to collect payment card data during the checkout process. This method continues to pose a significant threat to online retailers and their customers.
In December, Europol, in coordination with law enforcement agencies from 17 countries, warned 443 online sellers that their customers’ payment card information had been compromised due to e-skimming attacks.
The scope of this threat is staggering. In July 2024 alone, 3,799 e-commerce domains were infected with e-skimmers, according to a report by Recorded Future. Additionally, cybercriminals posted 18.6 million card records for sale on dark web carding sites that month, with 8.8 million records freely available.
The payment fraud landscape has shown signs of recovery, partly due to Russian law enforcement’s crackdown on domestic cybercriminals and the ongoing conflict in Ukraine. However, the scale of the problem remains immense. Recorded Future’s annual payment fraud report highlighted that 119 million payment card records were posted for sale on dark web platforms in 2023, leading to an estimated $9.4 billion in preventable fraud losses for card issuers and $35 billion in potential chargeback fees for merchants and acquirers.
In 2022, e-skimming attacks resulted in 45.6 million compromised payment card records being sold on dark web platforms, underscoring the persistent and evolving nature of this threat.
Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com
