Nonprofit organization Goodwill has started notifying users of its ShopGoodwill.com e-commerce platform that their personal information was compromised as a result of a cybersecurity breach.
The notice sent out by Goodwill via email was obtained by Australian researcher Troy Hunt, who runs the Have I Been Pwned data breach notification service.
The company has informed users that an “unauthorized third party” accessed buyer contact information, including name, email address, phone number and mailing address.
“No payment card information was exposed; ShopGoodwill does not store payment card information,” reads the email, signed by Ryan Smith, VP of ShopGoodwill.com. “While the third party accessed buyer contact information, they did not access your ShopGoodwill account.”
The organization said the website vulnerability exploited in the incident has been addressed.
The ShopGoodwill website is currently offline “for maintenance,” but it’s unclear if it’s related to the breach.
SecurityWeek has reached out to Goodwill for information on the number of impacted customers and will update this article if the organization responds.
Funded by its massive network of retail thrift stores, Goodwill provides job training, employment placement, and other community-based services. Goodwill has more than 150 local organizations in the United States and Canada, and a presence in a dozen other countries. The ShopGoodwill website affected by the breach generated more than $1 billion in sales since its launch in 1999.
This appears to be the second data breach disclosed by the nonprofit in the past decade.
In 2014, Goodwill informed customers that more than 800,000 payment cards had been compromised as a result of a breach at a third-party vendor. The affected payment processor confirmed at the time that hackers had access to its systems for more than a year.
Related: Fashion Retailer Guess Notifies Users of Data Breach
Related: Neiman Marcus Confirms Payment Cards Compromised in Data Breach
