Who this affects. Any business that takes card payments on its own website, and anyone who has bought from Shelly Store UK.
Pillars Devices and updates and Knowing your setup
What happened
Shelly Store UK, an independent reseller of Shelly smart home kit, has told customers their payment card details may be at risk. Names, billing addresses and contact details may also be involved. Shelly Group has said the shop is independent and it doesn't run the website.
A warning from its payment provider, Stripe, started the investigation. The retailer then found unauthorised software on its website and server. It says it has removed the software, tightened access, applied updates and added monitoring, and it has reported the incident to the ICO.
The shop says it can't yet tell whether card data was accessed or copied. At least one customer has reported a fraudulent payment made overseas, days after placing an order, and started a dispute with their bank before the shop's email arrived.
Why it matters to you
This looks like card skimming. Criminals hide a few lines of code on a checkout page and copy card details as customers type them in. It's the same kind of attack that hit British Airways in 2018.
Two things stand out for small businesses. Criminals target small online shops just as readily as big brands, because they're often easier to get into. And the shop didn't spot the problem itself. Its payment provider did, and at least one customer's bank was already dealing with fraud. If you sell online, you want to be the first to know, not the last.
What to do this week
If you sell online
- Ask whoever built your website whether customers type their card details into your own pages, or into your payment provider's hosted page. A hosted page, where customers pay on the Stripe, PayPal or Worldpay page itself, keeps card details off your server.
- Update your website platform, theme and plugins this week, and remove any you no longer use.
- Turn on multi-factor authentication for your website admin, your hosting account and your payment provider dashboard.
- Make sure alerts from your payment provider go to an inbox someone reads every day.
- Ask your developer or host whether they can alert you when files on your website change.
If you've bought from Shelly Store UK
- Check your card statements and report anything you don't recognise to your bank straight away. Ask your bank whether you need a replacement card.
- Change your password for the shop, and anywhere else you use the same one.
- Be wary of emails, texts or calls about the breach that ask for your card details or security codes. Criminals often follow up a breach with scam messages.
If it happens to you
If you find something wrong on your own website, take the checkout offline, tell your payment provider and your bank, and get help. If customers' personal data may have been exposed, you may need to report it to the ICO within 72 hours. My guide on who to call if you get hacked has the numbers.
Want a second opinion on your own setup?
Send me one quick question and I'll give you a plain English answer, usually within one working day.