Cyber Incident Victim: Amazon.com Inc.
Date:
May 2019
Location:
United States of America
Summary
Amazon experienced a significant cyberattack where hackers infiltrated approximately 100 merchant accounts, diverting funds from sales and loans into external bank accounts over a six-month period. The company characterized the incident as extensive fraud, involving unauthorized access to seller systems to siphon cash, which was later disclosed in legal proceedings.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Between May and October 2018, unidentified hackers conducted a sustained cyberattack against Amazon.com Inc., targeting the financial accounts of merchants operating on its platform. The attackers gained unauthorized access to approximately 100 seller accounts over this six-month period, exploiting these breaches to divert funds from merchant loans and sales revenue. Amazon later characterized the incident as an "extensive" fraud operation in legal filings, though the specific intrusion methods remained undisclosed. The company confirmed the attackers systematically redirected merchant funds to bank accounts under their control, indicating a financially motivated scheme rather than data theft. No evidence suggested customer accounts or Amazon's core retail infrastructure were compromised during this campaign.
Amazon first disclosed the breach through a November 2018 legal filing in the United Kingdom, though details remained redacted until public release in May 2019. The company described the attack as "serious" but did not quantify the total financial losses incurred by merchants or specify whether affected sellers received restitution. Legal documentation served as the primary confirmation of the incident, with no contemporaneous public disclosure during the active compromise window. The targeted timeframe and merchant-specific focus indicated attackers possessed operational understanding of Amazon's seller financial systems, particularly mechanisms governing fund disbursement. No attribution to specific threat actors or groups was provided in available records.