P2021-ND-112

On March 20, 2019, the Organization was contacted by its card payment merchant acquirer, Worldpay, regarding irregularities experienced by customers after purchasing goods on the Organization’s website, www.reddragondarts.com. The Organization’s investigation at the time of reporting indicated that the website was compromised by malicious code that collected data from the payment page, sending it to a remote server under the attacker?s control. The Organization reported there were two windows of compromise: September 9, 2018 to January 24, 2019 and March 4, 2019 to March 6, 2019, although the latter window may have begun as early as February 15, 2019.