Photography and personalized products platform Shutterfly is notifying employees that some of their personal information was compromised in a ransomware attack in December 2021.
Shutterfly operates numerous services and brands – such as BorrowLenses, GrooveBook, Lifetouch, Shutterfly, Snapfish, Spoonflower, and Tiny Prints – and helps users create cards, home décor, invitations, gifts, and more.
In December 2021, the online retail and manufacturing platform told SecurityWeek that portions of its network were crippled in the ransomware attack, including manufacturing and corporate systems.
Now, the company is informing employees that, during the time they had access to its network, the attackers compromised certain types of personal information, including names and other employment-related data, according to a copy of the notification letter that Shutterfly submitted to the California Attorney General’s Office.
[ READ: Shutterfly Says Ransomware Attack Impacted Manufacturing ]
The online platform also says that the attackers had access to its network for roughly 10 days before the breach was discovered: from December 3 to December 13.
“An unauthorized third party gained access to our network. This was what is known as a ‘ransomware’ attack. The attacker both locked up some of our systems and accessed some of the data on those systems. This included access to personal information of certain people, including you,” Shutterfly says.
The company hasn’t named the ransomware involved in the incident, but the infamous Conti gang claimed responsibility for the attack in January.
On their leaks website on the Tor network, the group published roughly 7 gigabytes of data allegedly stolen from Shutterfly, including several archives that appear to contain employment agreements, financial and legal documents, payroll data, and more.
Related: Microsoft, Okta Confirm Data Breaches Involving Compromised Accounts
Related: Over 1 Million Impacted in Data Breach at Texas Dental Services Provider
Related: Cookware Distribution Giant Meyer Discloses Data Breach

More from Ionut Arghire
- Google Leads $16 Million Investment in Dope.security
- Critical WooCommerce Payments Vulnerability Leads to Site Takeover
- PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw
- CISA Gets Proactive With New Pre-Ransomware Alerts
- CISA, NSA Issue Guidance for IAM Administrators
- Cisco Patches High-Severity Vulnerabilities in IOS Software
- ‘Nexus’ Android Trojan Targets 450 Financial Applications
- ‘Badsecrets’ Open Source Tool Detects Secrets in Many Web Frameworks
Latest News
- Intel Co-founder, Philanthropist Gordon Moore Dies at 94
- Google Leads $16 Million Investment in Dope.security
- US Charges 20-Year-Old Head of Hacker Site BreachForums
- Tesla Hacked Twice at Pwn2Own Exploit Contest
- CISA Ships ‘Untitled Goose Tool’ to Hunt for Microsoft Azure Cloud Infections
- Critical WooCommerce Payments Vulnerability Leads to Site Takeover
- PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw
- CISA Gets Proactive With New Pre-Ransomware Alerts
