Defender Ind. Data Breach

[FlyingScot]

I love defender. I have a bunch of items in my shopping cart right now. I just compared to Hodges Marine and half the items they don't sale. Others are the same or more money. I was part of the breach. Got the email. Created quite a bit of hassle for me (replacement card, multiple autopays, etc.) but I still like Defender and can excuse one mistake. If it becomes a pattern, I'll shop elsewhere.

[Sharki127]

Originally Posted by Sharki127

On Friday Defender Industries Marine Supply reported a data breach and promised further information which has not yet been provided. My bank confirmed that my card was compromised in the Defender breach. So I deactivated my card.

More information. Defender learned of the data breach on April 15. On April 30 they figured out what population of cards was affected. On May 21 that sent an alert to me by email. Some days later they posted a letter using the May 21 date.

I've been a Defender customer for 35+ years. They aren't the company they used to be.
Last November I won a fraud case against them for knowingly shipping damaged cans of bottom paint.

[Talk Story]

Entering hour two of sorting out financial nonsense from the Defender breach ... I'm pretty much done with them at this point. Been a customer for over 20+ years.

[hpeer]

I have had no related issues.

I just called IDX at the number provided and they were able to see that there had been no breach of MY data.

Don't know how they know that but we live in a magical world where stuff happens I do not understand.

[shimari]

I received the email, and a letter via USPS. I'm a Defender 1st member, and I've spent a great deal there over the past year doing refits.

My credit is frozen with all three agencies, and I have alerts set for charges over $5 on both cards used. Fortunately, no fraudulent activity yet.

I also happen to work in the computer security industry (30+ years now - yup I was doing it before the marketing departments latched onto it). We don't know the details of the breach at Defender. Defender could have taken reasonable precautions, and still been hacked. They might not have used best practice. We just don't know. I commend Defender for promptly notifying us. You'd be surprised how many companies don't.

The technology for using random credit cards has been around for 20+ years. I worked one of the first implementations. Random numbers didn't gain large acceptance because of the perceived costs of implementing them and the loss of market data, i.e. building user spending profiles for advertising. The latter being the biggest stumbling block. You're not only tracked by your online activity but your spending as well (and not just your credit card company).

As someone else on this thread said, protecting your infrastructure is hard and expensive. Large companies and governments can't do it well. Small e-commerce companies have the odds stacked against them. I say give Defender the benefit of the doubt until there's solid evidence they were negligent.

[SV Siren]

Originally Posted by Kamen

You should. It is absolutely their fault. Shoddy security practices. Totally avoidable.

Defender is not the CC processor, they hire that out, I am assuming in good faith, with IDX. That being said, I will still continue to shop with Defender, you can do what you deem best practices for yourself. Just know that every other online sales platform uses one CC processing company or another, which may/will be hacked at any one point or another. Jamestown, West Marine, or Fisheries Supply could be next. Random CC number generators seem to be a good way to go...

[Kamen]

Originally Posted by SV Siren

Defender is not the CC processor, they hire that out, I am assuming in good faith, with IDX. That being said, I will still continue to shop with Defender, you can do what you deem best practices for yourself. Just know that every other online sales platform uses one CC processing company or another, which may/will be hacked at any one point or another. Jamestown, West Marine, or Fisheries Supply could be next. Random CC number generators seem to be a good way to go...

If the breach was with their processor, it would impact hundreds or thousands of companies, not just Defender.

With modern payment gateways, it is possible to architect your e-commerce site so that you never handle actual CC numbers, even when you offer storing payment methods. You handle tokens instead, which are useless to fraudsters if compromised. Defender failed to do that.

[Motorsailer4me]

I had my Capital One card on file at Defender. I just got off the phone with Capital One. My card was used at a Footlocker and signed up for a subscription escort service. Lol. I am 65 years old and just had both knees replaced....sneakers? escorts? ..nope lol.

[sailorboy1]

Originally Posted by gonesail

why in the **** doesn't Defender accept Paypal? are you listening Defender .. or do you even care at this point

Well i hate paypal, so there

[ebisucapt]

My card was used by a third party. Card Company stopped all charges. But no idea if it was from the Defender breach or not.

[gonesail]

Originally Posted by Sharki127

Last November I won a fraud case against them for knowingly shipping damaged cans of bottom paint.

similar thing happened to me. I got a can that was seriously dented but the shipping box was not damaged at all. they claimed they would NEVER ship a dented can and refused to send a replacement. they are not good people

[Afrinus]

Irrelevant - they got transaction data, which includes your card details and address.

I got the letter from Defender (no email), and the next day I had a fraudulent charge on my account....

I don't save my card either....

Originally Posted by hpeer

Ditto. I dont store card on site.

[gonesail]

Originally Posted by Kamen

it is possible to architect your e-commerce site so that you never handle actual CC numbers, even when you offer storing payment methods. You handle tokens instead, which are useless to fraudsters if compromised. Defender failed to do that.

also the CC numbers or tokens should be encrypted. easily done and almost impossible to hack. unless of course it was an inside job. but storing transactions or sensitive data in clear text would be absolutely negligent and possibly criminal

[flyingfin]

Originally Posted by CCCruiser

Inexcusable breach in my opinion. I will decline to do business in the future with Defender. Adequate protection against hacking has been available in the IT industry for over 20 years. Companies that either have inadequate solutions or outsource their ecommerce to 3rd parties don't deserve my continued business as they have taken the cheap out path.

Hmmmm, I seem to remember the Social Security Admin and Equifax being hacked and their data compromised. There is no such thing as on-line security. Make sure you have multiple cards and dont link monthly payments to cards you use for on-line shopping. I have each of my monthly auto pay linked to different credit cards, that way when one gets hacked, I only have to put out one fire at a time.

[CaptTom]

Haven't shopped at Defender in a while, and no letter, so it looks like I wasn't impacted.

Two points to add to the above discussion:

1) The reason I haven't shopped there is they just don't seem to offer the value they did before. For a long time I tried. I logged on and comparison shopped for every marine purchase. They just never made the cut. I also loved their spring clearance garage sale or whatever they called it. Got both my air conditioners there, saved a ton.

2) I have a couple of dedicated credit cards just for automatic payments, nothing else. I learned that lesson the hard way when my card was compromised and reissued while I was out of the country, and away on a 3-month cruise. Try cleaning up that mess. I've thought about using a dedicated card just for on-line purchases, but it seems just as many hacks happen to brick-and-mortar stores these days anyway.