Advance Auto Parts has confirmed a serious security breach involving their third-party cloud provider’s environment, putting the personal data of potentially tens of thousands of individuals at risk.
Operating over thousands of locations across the United States and employing more than 67,000 people, Advance Auto Parts is a major player in the auto parts sector, with reported revenues surpassing $11 billion.
The breach was disclosed in a regulatory filing with the US Securities and Exchange Commission (SEC). Find out all the details below!
What Happened?
The ‘third-party’ mentioned by Advance Auto Parts likely refers to their use of Snowflake, a cloud platform. The breach, which stemmed from stolen credentials, also disrupted the databases of several other Snowflake clients.
The hacker stole three terabytes of data from Advance Auto Parts, which included a vast array of sensitive information about the company, its clients, and its employees. Moreover, the data sample shared by the attackers on a hacking forum seems to be authentic, as per multiple sources.
Advance Auto Parts info for sale on a data leak forum (Source: BleepingComputer)
How Did They Respond?
According to Advance Auto Parts, the attackers have accessed only employee-related data. “The Company believes that some files contain personal information, including but not limited to social security numbers or other government identification numbers of current and former job applicants and employees of the Company,” the SEC filing states.
The auto parts company has committed to notifying all impacted parties and will provide credit and identity restoration services free-of-cost to help mitigate the effects of the breach. The company anticipates that insurance will cover most of the costs related to the incident, yet the cyberattack is still expected to result in expenses of approximately $3 million.
Final Word
The data breach at Advance Auto Parts has exposed vulnerabilities in using third-party cloud services and the significant impact of cyberattacks. As the company takes steps to manage the aftermath, it serves as a crucial reminder for all businesses to tighten their data security protocols.
Anas Hasan
June 20, 2024
12 months ago
