• The rules for The Exchange can be found here. Please read and follow them. Stop using Paypal Friends & Family and follow our best practices to prevent getting ripped off or having a bad deal.

Bad BHQ Customer Credit Card Data Breach 2021

SpyderPhreak

Rocketman for hire
Platinum Member
Feedback: 65 / 0 / 0
Joined
Apr 13, 2004
Messages
16,123
Not terribly happy with BHQ right now. :mad: :poop: Lots of missteps lately at BHQ. o_O

Essentially, if you did business with them Jan 7 - Mar 22 of this year (2021), or on April 11, 2021, your credit card information may have been stolen, to include the CVV numbers. It is highly recommended to get a new card!!! I've already contacted my CC company.

I received this email from them about 30 minutes ago:

April 21, 2021

Dear XXXXXXXXX,

We value your business and respect the privacy of your information, which is why, as a precautionary measure, we are writing to let you know about a data security incident on the Blade HQ website that may involve your personal information. Although we are unaware of any actual misuse of your information, we are providing notice to you and other potentially affected customers about the incident, and about tools you can use to protect yourself against possible fraud.

------------------------------------------------------------------------------------------

What happened?

An unknown, unauthorized intruder or intruders appears to have gained access to our hosted website servers and uploaded malware to our website www.bladehq.com, potentially gaining the capacity to “skim” customer transaction data as it was being entered by the customers purchasing or attempting to purchase our merchandise. Our investigation indicates that the intruders may have had this “skimming” capability from January 7, 2021 through March 22, 2021 and on April 11, 2021. The attackers may have gained access to customer transaction information if the customer entered new or updated information at the site during that time. Because you entered or changed your card information or personal information at bladehq.com during the suspected period of intrusion, we are notifying you about this security incident.

You may wonder why you are hearing about the incident now. When we first became aware of potentially unusual activity on our website in late March, we immediately hired cybersecurity experts and forensic investigators to assist in our investigation. Applicable legal requirements and best practices require that we conduct a complete investigation and cooperate and follow the required protocols of applicable governmental authorities—in certain jurisdictions we are also required by law to ensure that certain additional steps be followed before notifying customers. Now that those steps and requirements have been completed and our investigation concluded, we are reaching out to you.

------------------------------------------------------------------------------------------

What information was involved?

In the cases mentioned above, information that the intruder may have had access to includes your first and last name, address, email address, and any debit or credit card numbers with expiration dates and CVV codes that you may have entered on our website.

------------------------------------------------------------------------------------------

What we are doing.

Blade HQ values your privacy and deeply regrets that this incident occurred. We have retained the services of a qualified cybersecurity forensic investigation firm to contain the breach, conduct a thorough review of the intrusion, and to ensure the security of the website now and in the future. The intruder’s access and malware have been removed from our website, and we have deployed new servers and implemented additional security measures to prevent a recurrence of such an attack and to protect the privacy of our valued customers. We are also working closely with major credit card suppliers and governmental authorities, to ensure that the incident is properly addressed.

------------------------------------------------------------------------------------------

What you can do.

Please also review the attachment to this letter for further information on steps you can take to protect your information.

For More Information.

For further information and assistance, please call our response center at (855) 723-1664 Monday through Friday from the hours of 8:00 a.m. to 5:30 p.m. Central Standard Time, excluding major US holidays.

We sincerely apologize for this inconvenience and are grateful for our relationship with you. Thank you for your support of Blade HQ.

Sincerely,

Mark Christensen

CEO, Blade HQ

------------------------------------------------------------------------------------------
 
This just came in. Check your email if you've done business with Blade HQ and watch your accounts.
*****************************
April 21, 2021

Dear,

We value your business and respect the privacy of your information, which is why, as a precautionary measure, we are writing to let you know about a data security incident on the Blade HQ website that may involve your personal information. Although we are unaware of any actual misuse of your information, we are providing notice to you and other potentially affected customers about the incident, and about tools you can use to protect yourself against possible fraud.
------------------------------------------------------------------------------------------

What happened?

An unknown, unauthorized intruder or intruders appears to have gained access to our hosted website servers and uploaded malware to our website www.bladehq.com, potentially gaining the capacity to “skim” customer transaction data as it was being entered by the customers purchasing or attempting to purchase our merchandise. Our investigation indicates that the intruders may have had this “skimming” capability from January 7, 2021 through March 22, 2021 and on April 11, 2021. The attackers may have gained access to customer transaction information if the customer entered new or updated information at the site during that time. Because you entered or changed your card information or personal information at bladehq.com during the suspected period of intrusion, we are notifying you about this security incident.

You may wonder why you are hearing about the incident now. When we first became aware of potentially unusual activity on our website in late March, we immediately hired cybersecurity experts and forensic investigators to assist in our investigation. Applicable legal requirements and best practices require that we conduct a complete investigation and cooperate and follow the required protocols of applicable governmental authorities—in certain jurisdictions we are also required by law to ensure that certain additional steps be followed before notifying customers. Now that those steps and requirements have been completed and our investigation concluded, we are reaching out to you.

------------------------------------------------------------------------------------------

What information was involved?

In the cases mentioned above, information that the intruder may have had access to includes your first and last name, address, email address, and any debit or credit card numbers with expiration dates and CVV codes that you may have entered on our website.

------------------------------------------------------------------------------------------

What we are doing.

Blade HQ values your privacy and deeply regrets that this incident occurred. We have retained the services of a qualified cybersecurity forensic investigation firm to contain the breach, conduct a thorough review of the intrusion, and to ensure the security of the website now and in the future. The intruder’s access and malware have been removed from our website, and we have deployed new servers and implemented additional security measures to prevent a recurrence of such an attack and to protect the privacy of our valued customers. We are also working closely with major credit card suppliers and governmental authorities, to ensure that the incident is properly addressed.

------------------------------------------------------------------------------------------

What you can do.

Please also review the attachment to this letter for further information on steps you can take to protect your information.

For More Information.

For further information and assistance, please call our response center at (855) 723-1664 Monday through Friday from the hours of 8:00 a.m. to 5:30 p.m. Central Standard Time, excluding major US holidays.

We sincerely apologize for this inconvenience and are grateful for our relationship with you. Thank you for your support of Blade HQ.

Sincerely,

Mark Christensen

CEO, Blade HQ
********************
The email continued...
 
I just got a notice from BladeHQ, use this as you see fit. I know I'll never go back there:

What happened?

An unknown, unauthorized intruder or intruders appears to have gained access to our hosted website servers and uploaded malware to our website www.bladehq.com, potentially gaining the capacity to “skim” customer transaction data as it was being entered by the customers purchasing or attempting to purchase our merchandise. Our investigation indicates that the intruders may have had this “skimming” capability from January 7, 2021 through March 22, 2021 and on April 11, 2021. The attackers may have gained access to customer transaction information if the customer entered new or updated information at the site during that time. Because you entered or changed your card information or personal information at bladehq.com during the suspected period of intrusion, we are notifying you about this security incident.
 
Intrusion hacks are happening everywhere from Fortune 500 companies to small businesses to sovereign governments. The only differentiating factor between those affected is how they protect the end users/clients whose personal data was compromised. I was not pleased with the response from Blade HQ. Breach happened one month ago and zero responsibility taken, nor assistance provided.
 
I hate to hear that. Glad that I didn't buy or do anything during that period.
 
Heartfelt letter to customers that absolves themselves of any fault (a month past the incident detection), but generously offers us a downloadable generic guide of how to protect ourselves going forward. Way too many vendors out there to put up with this lack of accountability!
 
this happens more than most of realize. some companies tell us some do not.

I have a single credit card I use only for online buying. it gets stolen via websites poor security and/or bad employee poor background checking etc at least 3 to 4 times a year.

I use a credit card and not a debit so I have zero hassle. I check it daily like I check my investments daily at lunchtime and when i see its gotten stolen I call and have the charges reversed immediately and card canceled and new one sent to me.

I was involved in this bladehq one. I got the email. the card number was stolen about a month ago....likely from this one, but who knows....could have been a half dozen other dealers ive used and they might not even know themselves.....likewise they could have a bad employee with access and have no idear too.

many places do not do background checks, or out of state ones or even credit checks, but they should.

that said I'm all for second chances and helping people who straighten their lives and mistakes out and they shouldn't be held back, but im talking about repeat offenders who never seem to learn or don't want to......
 
this happens more than most of realize. some companies tell us some do not.

I have a single credit card I use only for online buying. it gets stolen via websites poor security and/or bad employee poor background checking etc at least 3 to 4 times a year.

I use a credit card and not a debit so I have zero hassle. I check it daily like I check my investments daily at lunchtime and when i see its gotten stolen I call and have the charges reversed immediately and card canceled and new one sent to me.

I was involved in this bladehq one. I got the email. the card number was stolen about a month ago....likely from this one, but who knows....could have been a half dozen other dealers ive used and they might not even know themselves.....likewise they could have a bad employee with access and have no idear too.

many places do not do background checks, or out of state ones or even credit checks, but they should.

that said I'm all for second chances and helping people who straighten their lives and mistakes out and they shouldn't be held back, but im talking about repeat offenders who never seem to learn or don't want to......
I'm the same way, just one card for this kind of stuff. Luckily mine never had any fraudulent activity, but better safe than sorry.

You're right, sadly some places don't provide the legal notice that they're supposed to. You're just not safe anywhere anymore, even the credit card processors get hacked a lot. Doesn't matter how careful YOU as an individual are about it when the processors are getting hit. o_O :poop:
 
I find it frightening that such a big and modern company would store CC infos on their website without any kind of encryption.

I was always wary of "saving my CC infos for a quicker check out next time" and thought that I was over precautious. Guess I wasn't.
 
I find it frightening that such a big and modern company would store CC infos on their website without any kind of encryption.

I was always wary of "saving my CC infos for a quicker check out next time" and thought that I was over precautious. Guess I wasn't.
Read the letter in the OP again. I don't think that's quite how it worked. Sounds like the hackers were using a skimmer, which lifts the data after input, as it's being submitted for payment and/or storage. Likely before it's ever even encrypted. It doesn't sound like it was from anything being stored on their website (I rarely even do that, and it's only very temporarily if I do).
 
Back
Top