P2016-ND-50

On July 15, 2016, the Organization discovered that an unauthorized party had gained acces to one of its cloud-based website servers on June 25, 2016, which was removed that same day. The Organization removed the software on July 15, 2016. Subsequently, an unauthorized party added similar software on July 22, 216, which was removed that same day. The Organization’s investigation revealed that the unauthorized party or parties accessed personal payment card information of approximately 6,000 customers who had purchased from the Organization’s websites between June 25, 2016 and July 15, 2016.