Teddy House customer data breach after purchasing goods via website

[sicky]

Just a heads-up for others who have used the Teddy House website to order goods.  I have been receiving malware e-mails sent to a disposable e-mail address that I created specifically to place an order from this Thai company.  Initially I assumed it was just a virus on one of the Teddy House computers, which had obtained various e-mail addresses.  However, this doesn't appear to be the case, and it rather appears to have been a complete customer data breach.  The spammer appears to have obtained my other personal information in addition to my e-mail address.

 

Recently, I noticed that one of the malware messages quoted my birth date, as I had entered into the company's website.  The birthdate I entered wasn't actually my correct birthdate, but I recognised it was the date I entered into the website.

 

I reported this to a member of staff at Teddy House by e-mail but received no response.  Finally I logged into the company website and I found that they had purged the customer data (credit card, address and phone number, and date of birth).  It appears that Teddy House has been aware of the data breach but hasn't notified customers of this.  It is quite serious, given that credit card information was stored.  Although the company has at some point removed customers' main personal data, presumably as a weak attempt at resolving the problem, they haven't removed historic orders (which in turn contains personal information anyway), neither have they notified customers of any password reset for example.

 

I have always been wary of using Thailand e-commerce sites, because their ability to secure data is often extremely rudimentary, but this has been a lesson.  If you've ordered from Teddy House, you may want to double-check your credit card statement.

 

Edited December 22, 2017 by sicky