Cybercriminals Used a Fake Form to Steal Fitness Depot Customers' Information

The COVID-19 pandemic means that many people have a lot of free time and one fewer excuse for not working out. The gyms are closed, but there are plenty of online shops that sell fitness equipment and enable people to stay in shape during the lockdown. A cybercriminal gang spotted this and had no problems picking its next target.

Fitness Depot is a large Canadian sports equipment retailer that's been in the business for over 20 years, according to its website. It has dozens of brick and mortar outlets throughout Canada, but understandably, over the last few months, the focus has been on the ecommerce side of the business. Unfortunately, people who decided to buy fitness equipment from Fitness Depot's online store between February and May could have had their personal data stolen.

Fitness Depot reports a security incident

Nothing on Fitness Depot's website or official social media channels could lead you to believe that the retailer was targeted by hackers. Some of its customers, however, recently started receiving data breach notifications in their inbox, which suggest that the attack on Fitness Depot was actually pretty serious.

Apparently, cybercriminals first compromised Fitness Depot's ecommerce platform on February 18. They uploaded and redirected users to a "misleading" checkout form that harvested all the information entered on it, including names, email and physical addresses, telephone numbers, and credit card details.

Initially, the fake page affected only home delivery customers, but on April 28, the crooks updated the form, and it started targeting users who have opted for the in-store pick-up option as well. When they finally learned about the breach on May 22, Fitness Depot's IT specialists temporarily closed the online shop and took remediating actions. They now "believe" that the cybercriminals' access has been cut.

Was it Magecart?

The attack bears all the characteristics of a classic Magecart operation, but it's impossible to say with absolute certainty what it was because quite a few pieces of the puzzle are missing. On the whole, Fitness Depot's data breach notification is pretty uninformative.

We don't know, for example, how many people could have been affected by the breach. We also have no idea why it took the retailer three full months to learn that someone had compromised its website, and we can't be sure if it plans to help victims by offering to pay for identity theft protection services.

Fitness Depot seems to know who's to blame for the whole thing, though. An investigation apparently revealed that the retailer's ISP had "neglected to activate the anti-virus software" on its account. The notification doesn't say what sort of anti-virus software is supposed to protect the online shop, and there's no information on why a retailer selling hundreds of items to hundreds of thousands of users had to suffer a data breach in order to find out that its website was not secure.