Passwords, Addresses, and Payment Card Data Were Leaked During a Vision Direct Data Breach

Vision Direct, a large, multi-national online retailer of contact lenses, glasses, and other eyecare products recently suffered a data breach which exposed the personal information of some of its customers. This type of news is so common nowadays that people hardly bat an eyelid when they hear about the next in a long line of services getting hacked. Vision Direct's breach, however, is a bit different.

Usually, the crooks are after databases full of usernames, passwords, personal details, and other sensitive information. It's the service providers' responsibility to manage these databases, and unfortunately, sometimes, they don't do a very good job. Sysadmins often protect them with weak passwords, and in some cases, they don't protect them at all. With Vision Direct, there is no evidence of the actual database getting compromised. Instead, it was the website itself that was problematic.

The hackers got in on November 3, and although it's not clear how they did it exactly, it's obvious that they got deep within Vision Direct's infrastructure. They embedded a fake Google Analytics script into the source code of the retailer's main online shop, and for good measure, they also installed it on Vision Direct's regional websites in Belgium, Spain, France, Ireland, Italy, and the Netherlands.

For the next five and a half days, the malicious script remained undetected which goes to show that the crooks had done a good job of disguising it. On November 8, Vision Direct finally caught it and removed it from the affected websites. Then, the retailer was faced with the difficult task of explaining what had happened.

The bad news

The Google Analytics script was, in fact, a keylogger. Like a regular keylogger that crooks install on users' PCs, this one records keystrokes. The only difference is that it only logs the information that is entered on the affected website. This, in Vision Direct's case, includes usernames, passwords, names, emails, billing addresses, credit card details, etc.

This type of data is often stolen during a more conventional breach scenario where hackers make off with databases full of information. In most cases, however, vendors don't store a credit card's CVV code which limits the number of things a hacker can do with the stolen data.

Vision Direct said that they too don't store CVVs, but unfortunately, with the keylogger, the attackers were able to obtain the valuable three-digit numbers. The potential damage was more significant, though the attackers did have to make do with other limitations.

The not-so-bad news

Vision Direct broke the news about the breach on Sunday, and although they were a bit quiet about the number of affected people, they eventually told TechCrunch that the hack had put a little over 16 thousand users at risk. 6,600 could have had financial data compromised, and about 9,700 might have had their personal details exposed.

In the grand scheme of things, these numbers are not exactly huge, and that's because while a keylogger can steal some information that would otherwise be difficult to obtain, they can't siphon off data in bulk.

The good (or bad, depending on the perspective) thing about a keylogger is that it can't steal something the user hasn't entered. As a result, people who browsed the Vision Direct's websites without creating a new account or logging in to an existing one weren't affected in any way. The users that did enter their usernames and passwords, unfortunately, got their credentials exposed, but of them, only the ones that provided or updated personal and financial information had it compromised. To avoid any further, potentially serious consequences, people affected by the keylogger must ensure that their Vision Direct passwords aren't reused anywhere else.

Overall, it should be noted that this is far from the nastiest data breach we've ever seen. There are lessons to be learned, though, especially for Vision Direct.