E-commerce provider Shopify is reporting a data breach involving two rogue employees, who made off with customer data.
According to Shopify, the data breach impacted “less than 200 merchants” that rely on the e-commerce company to sell or send goods to internet users. Over 1 million merchants, including boutique shops and well-known brands, use the platform across the globe.
“Our investigation determined that two rogue members of our support team were engaged in a scheme to obtain customer transactional records of certain merchants,” the e-commerce provider wrote in a forum post on Tuesday.
In response, Shopify terminated the employees’ access to the company’s network. It’s also working with the FBI and other international law enforcement agencies on the investigation.
“While we do not have evidence of the data being utilized, we are in the early stages of the investigation and will be updating affected merchants as relevant,” the company said.
According to Shopify, the stolen data may have included customer orders made over the merchant’s websites, including names, email addresses, mailing addresses, and order details, such as what was purchased. Fortunately, no payment card data or other financial information appears to have been accessed.
The incident is another example of how rogue employees can become the weakest link in a company’s IT security chain. Last Friday, Amazon was ensnared in a similar incident involving company staffers receiving bribes to help sketchy merchants prop up their products.
Shopify refrained from naming the affected merchants, but the company says its in “close communication” with them regarding the data breach. How many internet users had their data exposed was also left unsaid. But if you’re a major user of Shopify-powered websites, don’t be surprised if you see a data breach notice in the near future.
