Cybercrime

Payment Card Data Stolen From AeroGrow Website

AeroGrow International, the company that makes the popular AeroGarden smart countertop gardens, recently informed customers that their payment card information may have been compromised as a result of a cybersecurity incident impacting its website.

Eduard Kovacs

April 8, 2019

In a letter sent to customers and submitted to the California Office of the Attorney General, AeroGrow said it had identified malicious code on its website’s payment page.

AeroGrow hacked The company’s investigation revealed that the malicious code had been present for more than four months, between October 29, 2018, and March 4, 2019. The malware was designed to harvest the card number, expiration date, and CVV/CCV code entered by customers on the payment page.

AeroGrow says no other type of personal information has been compromised, and it does not collect social security numbers, card PINs or financial account information.

Law enforcement has been notified and the company says it has taken steps to secure its systems. It has also decided to offer one year of free identity protection services to impacted individuals through Experian.

SecurityWeek has reached out to AeroGrow to learn how many customers have been impacted by the breach and will update this article if the company responds.

AeroGrow, a publicly traded company, reported a net revenue of $25.3 million for the last three quarters.

This is not the first time AeroGrow has reported suffering a payment card breach. Back in 2015, the company informed customers of a similar incident. At the time, the malicious code was present for more than six months and it captured names, addresses, payment card numbers, expiration dates and verification codes.

Written By Eduard Kovacs

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Latest News

Click to comment

Dealing With the Carcinization of Security

Varied viewpoints as related security concepts take on similar traits create substantial confusion among security teams trying to evaluate and purchase security technologies.

Marc Solomon

Stop, Collaborate and Listen: Disrupting Cybercrime Networks Requires Private-Public Cooperation

No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Derek Manky

How the Atomized Network Changed Enterprise Protection

Our networks have become atomized which, for starters, means they’re highly dispersed. Not just in terms of the infrastructure – legacy, on-premises, hybrid, multi-cloud, and edge.

Matt Wilson

Mapping Threat Intelligence to the NIST Compliance Framework Part 2

How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.

Landon Winkelvoss

Password Dependency: How to Break the Cycle

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the password dependency cycle. But how can this be done?

Torsten George

Application Security

Source Code Security Firm Cycode Launches With $4.6 Million in Funding

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Eduard KovacsSeptember 24, 2019