Boots Advantage Card accounts hacked

Recent news broke that Boots has suspended payments using loyalty points in shops and online after attempts to break into 150,000 customers’ accounts using stolen passwords.

Boots said none of its own systems were compromised, but attackers had tried to access accounts using reused passwords from other sites. Customers will not be able to use Boots Advantage Card points to pay for products while the issue is dealt with. This comes just days after a similar issue hit 600,000 Tesco Clubcard holders.

This incident, the result of “credential-stuffing” using PII from previous data breaches, re-emphasises the vulnerability of loyalty accounts and the attractiveness to fraudsters.

Michael Reitblat, CEO and Co-Founder of Forter, the leader in e-commerce fraud prevention, comments below:

“Recent high profile breaches demonstrate the growing underground market for loyalty program account data. It is becoming increasingly apparent that loyalty program accounts are low hanging fruit for fraudsters, with loyalty program fraud rising 89% year on year.

Reward points are a currency as valuable and untraceable as cash. Fraudsters can sell the loyalty account’s PII, or directly access accounts to redeem valuable reward points and coupons for themselves.

Suspending loyalty accounts causes massive inconvenience to consumers who miss out on their benefits, however temporary. Fraudulent activity in these accounts can negatively impact the customer experience, causing serious damage to brand reputation, and significant monetary losses to merchants.”