Sensitive data stolen in Gyft data breach
Gyft, a digital gift card platform that enables you to buy, send, and manage gift cards from hundreds of retailers, is notifying users who may have been affected by a security incident.
Beginning on October 3 and continuing through December 18, 2015, an unknown party accessed without authorization two cloud providers used by Gyft. Attackers were able to view or download certain Gyft user information stored with these cloud providers and made a file containing some of that user information.
The information potentially accessed included names, contact information, dates of birth, and gift card numbers. Gift card numbers could have been used to make unauthorized purchases.
In addition, Gyft log-in credentials may have been compromised. An unauthorized party who acquired credentials could have accessed a Gyft account and used any gift cards in the account with unused balances, reward points or a Coinbase-enabled account to purchase additional gift cards.
No credit cards stored in Gyft accounts were compromised. Full credit card numbers are not visible in Gyft accounts and all credit card purchases on Gyft require entering the card’s security code, which was not part of the information that may have been compromised.
Shortly after discovering this issue, Gyft acted to prevent unauthorized access by requiring users whose passwords were potentially compromised to reset their passwords, and logging out other affected users. The affected users who have not already changed passwords will be required to choose a new password the next time they log in.
Gyft recommends that users change their passwords for any online accounts where the same password was used for a Gyft account. In addition, if a user has a Coinbase account linked to a Gyft account, Gyft recommends that the user review any Coinbase transactions beginning in October 2015, because a linked Coinbase account could have been used to make purchases within a Gyft account.
Users should also monitor any gift cards that were in their Gyft account before January 8, 2016.