AIM Surplus had a data breach

[bender152]

Here's a thread on it on their arfcom industry page.

http://www.ar15.com/forums/t_2_217/275888_Security_breach_rumor.html

I have not received a letter, but others in the thread above are confirming that they have.

Below is a pic of the letter going out (not mine).
Here's a link to a larger version: http://imgur.com/POn92B0

[elSquid]

Got the letter today. 2 pages, double sided.

They're offering a year of credit monitoring by Experian. Must register by July 31.

-- Michael

[SonofWWIIDI]

Thanks for the headsup.

[frank8097]

Wtf? save that stuff on a flash drive for f's sake. last time i ordered from these turkeys, was maybe 2 years ago or a little less. hope someone doesn't take out a loan under my name.

[MarikinaMan]

Crap.

[peterabbits]

I got my letter last night. It's been at least 3 years since I bought from them, but still.

[Mac Attack]

Dang I have bought from them within the last 3 years.

[LowThudd]

Dam. I was just about to order from them as well.

So, I take it from the ARF.com thread, it is mainly that images of drivers licenses and FFLs were breached?

[Paulo]

sucks. I don't recall uploading any images to their site though. I mainly bought spare AR parts.

[beanz2]

I think the data they'd get from what I uploaded can already be obtained from my FB page.

[CALI-gula]

I read through the AR15.com thread, but I did not see any of my concerns addressed:

1) Any indication of how far back of orders they were holding DL imagery?

2) Last I ordered from them, I had a P.O. Box for billing, and all orders shipped to my office; however, my DL would have my home address on it like most other people. So to what address are they sending the letters? (So far, no letter for me but if they sent it to my prior ship-to or P.O. Box, worse still I won't get it but someone else might!)

3) If it's images breached, does that mean that saved PDFs of the order receipts would also have been captured? They aren't specifying what images were accessed.

4) WHY would they hold onto DL images for so long? I get it might be a CYA thing, but they should have purged those files at 6 months max or saved them off their network. Stupid.

.

[pbsmind]

Got my letter today. Might of exposed my DL and C&R License. Letter said financial data wasn't leaked but their uploaded documents were.

[hermosabeach]

who cares about financial data.... what a way to target homes to burglarize

[CALI-gula]

who cares about financial data.... what a way to target homes to burglarize

CA DOJ/BOF DROS filing website on deck.

.

[laurelpark]

Not sure if their username/password database was breached or not - but it would be wise to make sure that you don't re-use the username/password combo on any other site... Most people re-use them all over the place, so if one place gets hacked, all of a sudden the bad guys have your credentials in many other places.