Cyber Incident Victim: Vibram S.p.A.
Date:
Jun 2014
Location:
United States of America
Summary
A footwear company experienced a data breach when its third-party hosting provider was compromised, potentially exposing customer credit card information used for online purchases during a one-month period. The incident prompted the organization to transition to a new hosting provider and offer affected individuals complimentary credit monitoring services for one year. This security event occurred shortly after the company resolved unrelated class-action litigation alleging deceptive marketing practices regarding its products, though it admitted no liability in that settlement.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In August 2014, Vibram USA disclosed a cybersecurity incident affecting customers who made online purchases on vibramfivefingers.com between June 6 and July 7 of that year. The breach occurred when a third-party hosting provider responsible for processing the company's e-commerce transactions suffered unauthorized access. This intrusion exposed customers' credit card information used during online purchases within the impacted 31-day window. Vibram initiated direct mail notifications to affected customers starting August 6, accompanied by a PDF letter detailing the compromise. The company confirmed that stolen data specifically included credit card numbers but did not disclose the total number of impacted individuals or whether additional personal information was accessed. No technical details about the attack vector, attacker identity, or intrusion detection timeline were provided in the notification.
Vibram implemented two primary remediation measures following the breach: terminating its relationship with the compromised hosting provider and migrating its hosting services to an unnamed alternative vendor. The company also offered affected customers one year of complimentary credit monitoring through Experian’s ProtectMyID service. This incident occurred within a month of Vibram finalizing a $3.75 million settlement in a class-action lawsuit alleging deceptive marketing practices regarding health benefits of their FiveFingers footwear. While the settlement involved no admission of liability by Vibram, the consecutive occurrence of legal resolution and data breach amplified scrutiny of the company’s operational controls. No post-breach fraud incidents or direct financial impacts on customers were documented in the available notification materials.