Supply chain [SC] Supply Chain

Kylie Cosmetics Third-Party Breach (October 2020)

2020-10-01 [vendor] Shopify
Primary Source ↗

Incident Details

Shopify Data Breach - Arnold Law Firm. The Shopify data breach has affected thousands of merchants. Our lawyers can help you understand your legal rights and options for compensation. On September 22, 2020, e-commerce platform Shopify disclosed a security incident on their blog. Shopify reported that two “rogue” support team employees illegitimately accessed and stole customer transactional records of certain merchants, including Thrive Causemetics and Kylie Cosmetics. Third-party company: Shopify.

Technical Details

Initial Attack Vector
Compromise of third-party service provider / vendor relationship
Vendor / Product
Shopify
Supply Chain Attack
✅ Confirmed third-party / vendor compromise

Timeline

  1. 2020-10-01 Breach occurred
  2. 2020-10-08 Publicly disclosed