ClamCase

ClamCase, also known by its alias, is a company headquartered in the United States of America. It operates an online platform that enables customers to purchase goods and services, thereby collecting personal and payment information during transactions. The organization's primary market consists of consumers who rely on its website for retail purchases. Its business model centers on facilitating e‑commerce transactions and maintaining the associated customer data.

In April 2014, specifically on the fifteenth, attackers gained unauthorized access to ClamCase's website and remained inside the system for several months. During this period they exfiltrated customer purchase data that included names, mailing addresses, and credit card numbers. The compromised information was gathered over a multi‑month span, indicating a prolonged presence within the network. The incident was noted to be separate from the Backoff point‑of‑sale malware campaigns that affected other retailers at the time.

ClamCase discovered the breach internally, without relying on external alerts, and promptly began an investigation. The company removed the malicious components that had been installed by the attackers and took steps to secure its infrastructure afterward. To ensure a thorough response, ClamCase engaged third‑party security experts and coordinated with law‑enforcement agencies throughout the remediation process. The organization emphasized that the timing of its disclosure was not influenced by any external investigation and that no delay in notification resulted from those external efforts.

Although the exact number of individuals affected by the breach has not been made public, ClamCase offered impacted customers a set of protective services. Those services included identity‑theft insurance, professional consultation, and restoration assistance that required customers to activate the coverage themselves. The company presented these offerings as part of its commitment to help victims mitigate potential harm stemming from the exposed data. By providing these resources, ClamCase aimed to address the consequences of the incident while maintaining transparency about the limits of its disclosed impact.