Photography and personalized products platform Shutterfly is notifying employees that some of their personal information was compromised in a ransomware attack in December 2021.
Shutterfly operates numerous services and brands – such as BorrowLenses, GrooveBook, Lifetouch, Shutterfly, Snapfish, Spoonflower, and Tiny Prints – and helps users create cards, home décor, invitations, gifts, and more.
In December 2021, the online retail and manufacturing platform told SecurityWeek that portions of its network were crippled in the ransomware attack, including manufacturing and corporate systems.
Now, the company is informing employees that, during the time they had access to its network, the attackers compromised certain types of personal information, including names and other employment-related data, according to a copy of the notification letter that Shutterfly submitted to the California Attorney General’s Office.
[ READ: Shutterfly Says Ransomware Attack Impacted Manufacturing ]
The online platform also says that the attackers had access to its network for roughly 10 days before the breach was discovered: from December 3 to December 13.
“An unauthorized third party gained access to our network. This was what is known as a ‘ransomware’ attack. The attacker both locked up some of our systems and accessed some of the data on those systems. This included access to personal information of certain people, including you,” Shutterfly says.
The company hasn’t named the ransomware involved in the incident, but the infamous Conti gang claimed responsibility for the attack in January.
On their leaks website on the Tor network, the group published roughly 7 gigabytes of data allegedly stolen from Shutterfly, including several archives that appear to contain employment agreements, financial and legal documents, payroll data, and more.
Related: Microsoft, Okta Confirm Data Breaches Involving Compromised Accounts
Related: Over 1 Million Impacted in Data Breach at Texas Dental Services Provider
Related: Cookware Distribution Giant Meyer Discloses Data Breach