Mozilla Store Suffers Breach

One of the most visible ways to show your love for Firefox and all things Mozilla — at least in the offline world — is by sporting some of the wide range of Mozilla swag. The primary source of those items, however, is unavailable today, after the organization's online store was hit by a security breach.

According to a posting on The Mozilla Blog, Mozilla learned yesterday that the company operating the organization's U.S. storeGatewayCDI — experienced a security breach. Mozilla immediately closed the shop as a precaution, and although it is run by a different group, closed the International Mozilla Store as well. Current visitors to either shop receive the message that "The Mozilla Store has been closed for maintenance."

According to Mozilla's post, an investigation is under way to determine the cause and extent of the break-in — the organization has committed not to reopen the shop until concerns about privacy and security can be assuaged. The International Store will presumably undergo a precautionary audit and, given that it is operated by a separate entity, be reinstated on its own schedule. The Mozilla Community Store, which — as its name suggests — sells merchandise created by members of the Mozilla community, is operated by a third unrelated company, and remains open.

According to Mozilla, they encouraged GatewayCDI to immediately contact affected customers directly to advise them of the issue and potential consequences. Interestingly, though the breach was discovered and disclosed yesterday, at least some customers — your editor included — were not notified of the incident by GatewayCDI until late this afternoon.

According to their emailed notice, GatewayCDI doesn't believe any credit card data was compromised in the attack, but has confirmed that at least some customer's usernames and passwords were breached. Notified users are strongly encouraged to change their username/password as a precaution — users would do well to do so for all their Mozilla-related accounts, particularly if they use the same username/password in multiple places. Though it is currently impossible to do so as the site is offline, the company indicated it will notify users when the store is operational again — hopefully without waiting twenty-four hours or more to do so.


Justin Ryan is a Contributing Editor for Linux Journal.

One Click, Universal Protection: Implementing Centralized Security Policies on Linux Systems

As Linux continues to play an ever increasing role in corporate data centers and institutions, ensuring the integrity and protection of these systems must be a priority. With 60% of the world's websites and an increasing share of organization's mission-critical workloads running on Linux, failing to stop malware and other advanced threats on Linux can increasingly impact an organization's reputation and bottom line.

Learn More

Sponsored by Bit9

Linux Backup and Recovery Webinar

Most companies incorporate backup procedures for critical data, which can be restored quickly if a loss occurs. However, fewer companies are prepared for catastrophic system failures, in which they lose all data, the entire operating system, applications, settings, patches and more, reducing their system(s) to “bare metal.” After all, before data can be restored to a system, there must be a system to restore it to.

In this one hour webinar, learn how to enhance your existing backup strategies for better disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible bare-metal recovery solution for UNIX and Linux systems.

Learn More

Sponsored by Storix