Mozilla Store Suffers Breach
One of the most visible ways to show your love for Firefox and all things Mozilla — at least in the offline world — is by sporting some of the wide range of Mozilla swag. The primary source of those items, however, is unavailable today, after the organization's online store was hit by a security breach.
According to a posting on The Mozilla Blog, Mozilla learned yesterday that the company operating the organization's U.S. store — GatewayCDI — experienced a security breach. Mozilla immediately closed the shop as a precaution, and although it is run by a different group, closed the International Mozilla Store as well. Current visitors to either shop receive the message that "The Mozilla Store has been closed for maintenance."
According to Mozilla's post, an investigation is under way to determine the cause and extent of the break-in — the organization has committed not to reopen the shop until concerns about privacy and security can be assuaged. The International Store will presumably undergo a precautionary audit and, given that it is operated by a separate entity, be reinstated on its own schedule. The Mozilla Community Store, which — as its name suggests — sells merchandise created by members of the Mozilla community, is operated by a third unrelated company, and remains open.
According to Mozilla, they encouraged GatewayCDI to immediately contact affected customers directly to advise them of the issue and potential consequences. Interestingly, though the breach was discovered and disclosed yesterday, at least some customers — your editor included — were not notified of the incident by GatewayCDI until late this afternoon.
According to their emailed notice, GatewayCDI doesn't believe any credit card data was compromised in the attack, but has confirmed that at least some customer's usernames and passwords were breached. Notified users are strongly encouraged to change their username/password as a precaution — users would do well to do so for all their Mozilla-related accounts, particularly if they use the same username/password in multiple places. Though it is currently impossible to do so as the site is offline, the company indicated it will notify users when the store is operational again — hopefully without waiting twenty-four hours or more to do so.
Justin Ryan is a Contributing Editor for Linux Journal.
Today five randomly drawn entrants will win:
Rock, Paper, Scissors, Lizard, Spock mug and LJ subscription
Enter to Win
|December Daily Giveaways are Back!||Dec 01, 2015|
|December 2015 Video Preview||Nov 30, 2015|
|Take Control of Your PC with UEFI Secure Boot||Nov 30, 2015|
|Geek Hide-away in Guatemala - Stay for Free!||Nov 26, 2015|
|Microsoft and Linux: True Romance or Toxic Love?||Nov 25, 2015|
|Non-Linux FOSS: Install Windows? Yeah, Open Source Can Do That.||Nov 24, 2015|
- Take Control of Your PC with UEFI Secure Boot
- Cipher Security: How to harden TLS and SSH
- Perceptions of the Linux OS Among Undergraduate System Administrators
- Non-Linux FOSS: Install Windows? Yeah, Open Source Can Do That.
- Firefox's New Feature for Tighter Security
- Web Stores Held Hostage
- December Daily Giveaways are Back!
- Getting a Windows Refund in California Small Claims Court
- Simple Photo Editing, Linux Edition!
- Microsoft and Linux: True Romance or Toxic Love?