Warner Music Group Finds Hackers Compromised Its Online Stores

Warner Music Group Finds Hackers Compromised Its Online Stores

Image: Jared Arango

Warner Music Group (WMG), the third-largest global music recording company, has disclosed a data breach affecting customers’ personal and financial information after several of its US-based e-commerce stores were hacked in April 2020 in what looks like a Magecart attack.

With a history of over 200 years, WMG has more than 3,500 employees and it operates in over 70 countries via a network of subsidiaries, affiliates, and non-affiliated licensees.

WMG also owns the Warner Chappell Music music publisher and some of the most successful recording labels in the world including but not limited to Elektra, Warner Records, Atlantic, Warner Classics, Parlophone, and Warner Music Nashville.

US online stores compromised since April

The company said that the incident involved multiple e-commerce websites it operates via an external service provider and that the security breach may have enabled hackers to steal personal info entered into the sites

“On August 5, 2020, we learned that an unauthorized third party had compromised a number of US-based e-commerce websites WMG operates but that are hosted and supported by an external service provider,” the company said in a breach notification letter sent to affected individuals.

“This allowed the unauthorized third party to potentially acquire a copy of the personal information you entered into one or more of the affected website(s) between April 25, 2020 and August 5, 2020.”

Even though WMG’s investigation didn’t find any signs of information being exfiltrated, it doesn’t exclude the possibility of it happening and warns affected individuals of the risk of fraudulent activity that could be carried out using stolen personal and financial details during the attack.

Also read: The Scope Of Singapore Privacy: How We Use It In A Right Way

Credit card details potentially stolen

WMG also said that all information entered by those affected in the compromised online stores was potentially harvested and stolen by the attackers after placing items in the shopping carts.

Potentially stolen information could have included the customers’ names, email addresses, telephone numbers, billing addresses, shipping addresses, and payment card details (card number, CVC/CVV, and expiration date).

However, per WMG’s letter, information entered while making payments through PayPal on the hacked e-commerce sites was not affected.

“Upon discovering the incident we immediately launched a thorough forensic investigation with the assistance of leading outside cybersecurity experts and promptly took steps to address and correct the issue,” WMG added. “We also notified the relevant credit card providers as well as law enforcement, with whom we continue to cooperate.”

WMG offers 12 months of free identity monitoring services through Kroll to those affected and encourages them to “remain vigilant for any unauthorized use of your payment cards or suspicious email communications, particularly those purporting to come from Warner Music Group or any WMG-related websites.”

Possible Magecart attack

“E-commerce websites operated by Warner Music Group through a third party e-commerce platform were targets of a cybersecurity attack, which potentially exposed credit card and related data that customers entered into the sites,” a Warner Music Group spokesperson told BleepingComputer.

“With the assistance of cybersecurity experts, a full investigation was launched and we are in the process of notifying potentially affected customers. As a result, we are putting in place additional measures to prevent future breaches.”

Even though WMG didn’t provide any information on how the attackers were able to compromise the stores and potentially get their hands on the customers’ personal and financial data, this attack has all the signs of a textbook Magecart attack.

In such attacks, cybercrime gangs known as Magecart groups hack their way into e-commerce store sites and to inject malicious JavaScript-based scripts within their checkout pages’ source as part of web skimming (also known as e-skimming) attacks.

Their end goal is to harvest all the payment or personal info submitted by the compromised online stores’ customers and to collect it on remote servers under their control.

Update: Added WMG statement.

Also read: 10 Tips For Drafting Key Terms In A Service Agreement