Knit Picks Credit Card Security Compromised

[siliconsara]

I hate to be the bearer of bad news, but I thought this was pertinent to the community since I believe some of us have purchased yarn and other stuff from Knit Picks.

If you ordered something from the Knit Picks online store from late 2012 to 2013 then you need to call your CC company/Bank post haste to report the card lost/stolen and to see if there are any fraudulent charges.  Someone used a security exploit of the web software that handles transactions to gain access to the consumer database for online orders.  They say even if you did not order from KP recently but in the near past, it is a good idea to report the card you used and check your statements.  I ordered from them a few years back and did not hesitate to report my card and cut it up just now.

Here's the official statement from the CEO.

Here is a guide (unofficial) for those who might have been compromised.

The facebook page for KnitPicks is alive with discussion about this mess.

Comments

[siliconsara]

They say they contacted affected customers, so unless you got a letter, the best thing to do (because changing your CC# everywhere is a pain in the fucking ass) is probably to just watch your statement extra closely for a while, rather than cancelling the card as stolen -- that's what I'd do, at least. You're not liable for any fraudulent charges either way.

The only problem is that some people who haven't ordered with KP in a while have recently received fraudulent charges on the card they used with KP, so even if you may not have ordered with them recently, you may still be affected, letter or not. (ravelry members have reported this occurrence)

[carynb]

Yeah, I ordered from Knitpicks a little earlier than their time frame, (early December) and it looks like my info got stolen. I got a call from Visa 2 weeks ago about probable fraudulent charges that had just happened. And yes, they were fraudulent. The Poker sites just didn't mix in with all the Kobo, Amazon, and Paypal charges on the card, I guess. :-) Thank gods for Visa's unlikely-purchases algorithms.

I haven't received a letter yet, either, but I'm Canadian and the letter from the CEO did say that the Canadian letters haven't been sent yet.

[quartzpebble]

Yeah, I did not order in that time period and two of my cards were compromised. I don't know if they sent any notification because I have moved since ordering (I think the last time I ordered was summer 2012).