Credit card users who ordered University of Alabama merchandise from Bamastuff.com may have had information stolen. (The Huntsville Times/File photo)TUSCALOOSA, Alabama – University of Alabama fans who bought items from Bamastuff.com between Aug. 1, 2009, and Jan. 16, 2012, are being alerted to contact their banks for possible illegal and unauthorized use of their credit cards.
Bamastuff.com has sent out email notifications informing customers about a breach in its database, which was discovered this week by the company’s IT director, David H. Jones.
In his email, Jones says information including customers’ names, email addresses, billing and shipping addresses, telephone numbers, credit card information and/or a cryptographically scrambled passwords (not the actual password) could have been stolen.
“We can’t tell you how sorry we are this has happened and apologize for any inconvenience this has caused,” Jones said in the email. “We are still investigating to see how it happened and to figure out exactly what was taken but to err on the cautious side we wanted to inform you of this incident. “
In a phone interview with The Huntsville Times, Jones said he knows of numerous fraudulent charges made on Bamastuff.com customers’ bank accounts.
“Most have been reversed, but we just don’t know about others yet,” he said.
Jones urged everyone receiving his email to contact their bank and to change their password if it is the same as the one used to make orders with Bamastuff.com.
“We are still investigating the server’s log files to pinpoint exactly what was taken and how, but we suggest if you have not already taken action (due to prior bank notification) to cancel and/or change your credit or debit card associated with your order, to do so immediately,” he wrote.
The email included the expiration date of the card used so customers will know which card was used, although most are likely past their expiration date, he said.
“We wanted to be safe and alert everyone regardless of how old the data was,” he wrote. “If you receive multiple emails, it is because you had multiple cards in the system for different orders.”
Jones said they are fairly certain that orders placed after Jan. 16 are not affected based on the access logs on the server.
“It appears to be a one time attack and we have taken numerous steps to fend off any future ones,” he said. “We suggest those who placed their first order with us after (Jan. 16) to monitor their bank statements for any fraudulent activities.”
Jones also said old orders, including names, addresses and credit card numbers, are being archived and customer data is being deleted from the system for those not placing an order with Bamastuff.com since the start of the 2009 season.
“We also recommend that you change your password on any other website where you use the same or a similar password,” he said, and cautioned customers to never give out their account number over the phone or in an email if they receive a call from someone claiming to be with Bamastuff.com.
To protect against future theft, he said the company has upgraded and installed various security software to monitor activity.
Customers are asked to go to Bamastuff.com’s account page and sign in and click “Password.” but Jones said don’t worry if you can’t log into the system.
“We removed all orders older than Aug. 1, 2009, and then all customer and address information that no longer had an ‘active’ order in the system. so if it says you don’t exist, you haven’t ordered since August 2009 and are no longer in our database.”
For questions, concerns or comments, a special email account has been set up at ccinfo@bamastuff.com.
Tide fans ordering from Bamastuff.com may have had credit card information stolen