Did Target Sports USA buy AmmoToGo's customer list from Russian hackers?

[Arizona_Mike]

Did Target Sports USA buy AmmoToGo's customer list from foreign hackers?

That is the allegation in a security alert that went out today. I have no association with either company except having ordered from both in the past.

Dear Customers,

I am sending you this e-mail to inform you of a malicious hacker attack against AmmoToGo.com and to sincerely apologize to you for any inconvenience that it may have caused you. We believe it is our responsibility to inform you of this matter, so please read on.

AmmoToGo.com is a small business and we do our best to serve you, to run a reputable business, to support the shooting community, and to overcome challenges like this one.

Here are the highlights:

1. We do not sell any customer information, whatsoever.

2. Last week, another online ammunition retailer was approached by what appears to be a foreign hacker offering to sell the AmmoToGo.com customer/e-mail list, and that retailer kindly alerted us of this contact.

3. Our team immediately began investigating and confirmed yesterday that a portion of our customer/e-mail list was in fact breached and offered for sale.

4. Additionally, one of our customers reported late last night that they had received an e-mail from Target Sports USA to an e-mail address that had only been given to us (we can only deduce that Target Sports USA bought the list from the hacker and then began to abuse it).

5. In late August (for unrelated reasons), we re-launched our website on a far more secure and restricted platform that uses secure encryption, that is actively monitored against brute force attacks, that is protected by an intrusion prevention system, and that is pro-actively audited quarterly by a PCI compliance monitor.

6. As a precaution against precisely this kind of malicious hacker attack, we do not store credit card information and we have no reason to believe that any credit card information was stolen.

7. We are certain that FOID’s, driver’s licenses, or other government issued identification remained secure and were never accessed.

8. We have no reason to believe that any further attacks have occurred since late August, 2014 when we updated to our new secure database and we are now much better prepared to fend off any future attacks.

9. It is possible that the hacker obtained your*AmmoToGo.com password. As a precaution, we recommend that you go here to change your password and if you have used the same password on another website, we recommend that you change it there also.

10. We are certain that many of our customers are unaffected by this attack and we sent this e-mail to only those customers that could be affected.

If you receive any unsolicited e-mails from other online ammunition retailers, please forward their e-mail to us at [email protected] so that we can immediately investigate the matter and put an end to the SPAMing. Our team will work as long and as hard as necessary to fight back against the hacker and anyone else who buys and abuses the stolen information.

We look forward to re-earning your trust in the future and again apologize for this breach. If we find any additional information as our investigation develops, we will update this page with that information.

Scott

Customer Service Manager
AmmoToGo.com

Ammunition To Go, P.O. Box 3109, Houston, Houston TX 77253, United States

You may unsubscribe or change your contact details at any time.

Mike

 

[Gaucho Gringo]

Well that might explain why my email account that has been spam free for about 8 years suddenly started getting spam. I use it as my account for transacting online business. I have 8 others I use for various things.

 

[Impureclient]

Did Target Sports USA buy AmmoToGo's customer list from Russian hackers?

It appears that answer is yes. I have been getting a higher number of emails from places that I haven't dealt with also. Could be a coincidence but Ammotogo's explanation makes more sense.
As long as nobody is taking money from my credit card, which I am covered from fraud with either way, I am OK with them wasting time sending me emails. Most transactions taken place online
also ask for the 3 digit code on the back of the card that online retailers do not save even if they have your card saved for future purposes. Unless they physically have the card, we should be safe.

 

[19-3Ben]

I would love to know which other ammo retailer rejected the email list and alerted ammotogo when approached by the hackers. Admirable. I mean, it's just the right thing to do, but it deserves to be applauded in this day and age when the right thing is all too often the less commonly done thing.

 

[schwenkydave]

Got the same

I received that Email to and I too have purchased from both. I forwarded on to TSU. I think they ought to be aware they are being implicated and defend themselves if the claim is false. I find it reckless of AmmoToGo to blast that out to their whole customer base on the word of one customer. What if they guy was mistaken and he did supply that email once and just didn't remember. Slandering a company and endangering their livelihood should be done with a lot more evidence, if at all.

 

[rhinoh]

Yep- I'm an ATG customer.
I also got an email from Target Sports yesterday, have never bought from them and have never before received email from them.
Don't know if it is coincidence but then today someone tried to change my ebay password...

This hacking business is getting to be a real pain- I got my third Discover card last week in just a few months, someone somewhere hacked into that info-again. Getting really tried of changing my account number as I have several automatic billings going to Discover.

 

[rhinoh]

As long as nobody is taking money from my credit card, which I am covered from fraud with either way, I am OK with them wasting time sending me emails. Most transactions taken place online
also ask for the 3 digit code on the back of the card that online retailers do not save even if they have your card saved for future purposes. Unless they physically have the card, we should be safe.

Well physically having the card is easily spoofed- Discover once gave a $3000 cash advance to a person they claimed had my card. They were very stubborn about it and kept insisting the woman had my card- told them repeatedly I was holding it in MY hand looking at it....

 

[jmace57]

Yep - I got emails (for the first time ever) from Target Sports Oct 31 and Nov 1.

 

[Invisible Swordsman]

I started getting emails a few days ago from an outfit called Freedom Munitions. I had never heard of or done business with them.

I got the email from Ammo to Go today also. it's been five years since i bought anything from them.

 

[captmoto]

I have never bought anything form ATG and now I get emails from them weekly.

 

[RustyShackelford]

Target Sports USA....

I ordered a box(25 rounds) from Target Sports USA in 2011. I asked for Golden Saber 9x19mm bonded 124gr +P. Target Sports USA claimed to offer the bonded type loads but they(either the warehouse staff or the website makers) confused BJHP. Thinking the B meant bonded not brass.
Remington's Golden Saber bonded boxes have the label: bonded.
I sent Target Sports USA a email to ask them to correct the mistakes & change the product description to avoid future errors/upset customers but they never sent a reply.

I would not buy any products or order items from Target Sports USA.
They have poor QC and are a low end, unethical business.

 

[MifflinKid]

I have purchased from Target Sports USA two times without a problem.

Their prices are OK and if you purchase some ammo in 5K amounts shipping is free.

I initially bought from them in July 2012 but have never got any spam from them.

 

[NOMI WASP]

I've visited targetsports webiste a couple times. Their website looked real janky and I didn't feel comfortable putting in my card data.

 

[desidog]

I have ordered from TargetsportsUSA; and it went fine.

My impression (from googling the address), is that it is a business run out of a residential house; IIRC, the guy had an Eastern-European sounding name, and it appeared he just middle-manned by ordering my order from somewhere else, received it and forwarded it on to me, as evidenced by the shipping label on the box within the box i received.

 

[Steve CT]

Well that might explain why my email account that has been spam free for about 8 years suddenly started getting spam. I use it as my account for transacting online business. I have 8 others I use for various things.

Absolutely the smartest thing to do. I have several e-mail addresses, and different people/businesses are accessed through an e-mail specific to the company or type of business/organization.

Recently my longtime primary was hacked and used for some pretty widespread spam attacks. I'm sorry that friends and family were subjected to that, I was able to notify them quickly and suggest an alternate.

The upside for me was a couple of years worth of email lists that I was on, and did not need their weekly (or more often) messages suddenly went away.

 

[pjeski]

I'll also pipe up for targetsportsusa. I've bought a lot of ammo from them. There prices are good, but not consistently good. Free shipping on cases (not necessarily 5000).

If they did this, I'm a little disappointed. But AmmoToGo calling targetsportsusa out publicly based on hearsay is pretty low IMHO. (I got the email from AmmoToGo)

 

[schwenkydave]

Oddly enough, Freedom Munitions advertises on this site. Or maybe those are Google targeted ads and they are advertising to me because I was on AmmoToGos list...

 

[pjeski]

I have ordered from TargetsportsUSA; and it went fine.

My impression (from googling the address), is that it is a business run out of a residential house; IIRC, the guy had an Eastern-European sounding name, and it appeared he just middle-manned by ordering my order from somewhere else, received it and forwarded it on to me, as evidenced by the shipping label on the box within the box i received.

http://www.targetsportsusa.com/t-aboutus.aspx

Doesn't look residential to me.

 

[Agsalaska]

I am surprised this has not been mentioned yet, but that is a SERIOUS allegation. They better be right, and I hope they consulted an attorney before sending that email.

IF that allegation is true, someone is going to be in some really serious trouble.

 

[buckhorn_cortez]

I've purchased 10's of thousands of rounds from Target Sports. When you price ammunition, you have to figure shipping as part of the cost per round. If you buy in cases from them, the shipping is free - this often makes their cost per round less expensive than what appears to be cheaper price with additional shipping.

For all of those who think they are "janky," or working out of a house - here is a link to a photograph of their offices and warehouse. Looks awfully substantial to me.

The owner of Ammo to Go had better be really certain that Target Sports knowingly purchased directly from the hackers, as there are many, many places to purchase email lists.

 

[stompah]

Just because Target Sports may have bought a list doesn't mean they knew its true source.

 

[max popenker]

I love how anything suspicious and foreign is always attributed to Russian hackers.

Like USA is short of their own computer bandits, and there's no other country with access to Internet.

 

[RustyShackelford]

Your right....

The USAF Cyber Command says the US faces approx 300 cyber attacks or threats from China everyday.
And don't forget Iran, North Korea, India.... ....

 

[Arizona_Mike]

I love how anything suspicious and foreign is always attributed to Russian hackers.

Like USA is short of their own computer bandits, and there's no other country with access to Internet.

Actually the headline is my misreading/misremembering of the email. Looking back at the email they reported that they were approached as "foreign hackers" not "Russian hackers". I'll see if I can still fix the title.

Edit: Yes, I was able to correct the title.

Mike

 

[bani]

Just because Target Sports may have bought a list doesn't mean they knew its true source.

NOBODY should buy ANY email list. period.