Wednesday, April 2, 2025
HomeCyber Security NewsBodybuilding.com Data Breach, Resulting from Phishing Attack Via Email

Bodybuilding.com Data Breach, Resulting from Phishing Attack Via Email

Published on

SIEM as a Service

Follow Us on Google News

Bodybuilding.com, the internet’s biggest online store and an online forum for fitness and bodybuilding enthusiasts, recently became aware of the Data Security Incident that impacted its IT systems and announced that some of their customer related information may have been accessed cause of this.

It is one of the internet’s most visited sites, which has over seven million registered users on its forum, and its website receives over 30 million visitors per month. The last time the site dealt with a major security issue was in 2008 and now in 2019.

How the Breach Occurred

Bodybuilding.com was hit by a security breach, which involved unauthorized access to their systems. The store became mindful of it in February 2019 and engaged the data security firms to conduct a thorough investigation on it.

Investigation proved the unauthorized activity, which occurred due to a phishing email received in July 2018. Hackers used this data they obtained from the phishing email to access the company’s network in February 2019.

The company didn’t say when it detected the intrusion, but it said it concluded its investigation on April 12, and could not rule out that personal information may have been accessed or not.

Data Affected

The possible information that could have been accessed might be the Customer’s name, email address, billing/shipping addresses, phone number, order history, any communications with Bodybuilding.com, birthdate, and any information included in the BodySpace profile, says “BodyBuilding”.

The company confirms that Social Security numbers and payment card details were not exposed, says the Company, as the site never collected this information in the first place but it also declares that the last four digits of the payment card could have been disclosed as it is stored when a customer opts to save their card for future use.

“While the Company has no evidence that personal information was accessed or misused, Bodybuilding.com is notifying current and former employees who are group health plan enrolls and relevant dependents and beneficiaries, out of an abundance of caution,” Bodybuilding.com stated in a press release.

You can follow us on Linkedin, TwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Also Read

Microsoft Hacked – Hackers Compromised The Microsoft Employee’s Account to Gain Access the Customers Email

540 Million Facebook Users Personal Data Exposed to the Public Internet

Latest articles

Brinker Named Among “10 Most Promising Defense Tech Startups of 2025”

Brinker, an innovative narrative intelligence platform dedicated to combating disinformation and influence campaigns, has...

Hackers Use DeepSeek and Remote Desktop Apps to Deploy TookPS Malware

A recent investigation by cybersecurity researchers has uncovered a large-scale malware campaign leveraging the...

SmokeLoader Malware Uses Weaponized 7z Archives to Deliver Infostealers

A recent malware campaign has been observed targeting the First Ukrainian International Bank (PUMB),...

New Malware Targets Magic Enthusiasts to Steal Logins

A newly discovered malware, dubbed Trojan.Arcanum, is targeting enthusiasts of tarot, astrology, and other...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Hackers Use DeepSeek and Remote Desktop Apps to Deploy TookPS Malware

A recent investigation by cybersecurity researchers has uncovered a large-scale malware campaign leveraging the...

SmokeLoader Malware Uses Weaponized 7z Archives to Deliver Infostealers

A recent malware campaign has been observed targeting the First Ukrainian International Bank (PUMB),...

New Malware Targets Magic Enthusiasts to Steal Logins

A newly discovered malware, dubbed Trojan.Arcanum, is targeting enthusiasts of tarot, astrology, and other...