Warner Music discloses months-long web skimming incident

Music recording powerhouse Warner Music Group has disclosed today a security incident that involved some of the company's online stores.

Called "web skimming" or "magecart," this type of attack happens when hackers take control over a website and insert malicious code that logs customer details entered inside payment forms.

In a data breach notification letter filed today with the Office of the Attorney General in the state of California, Warner Music said it suffered one such attack earlier this year.

Between April 25 and August 5, Warner Music said hackers compromised "a number of US-based e-commerce" that were "hosted and supported by an external service provider."

"Any personal information you entered into one or more of the affected website(s) between April 25, 2020 and August 5, 2020 after placing an item in your shopping cart was potentially acquired by the unauthorized third party," the company said.

"This could have included your name, email address, telephone number, billing address, shipping address, and payment card details (card number, CVC/CVV and expiration date)."

Payments made through PayPal were not impacted, Warner Music added.

However, this is about where the data breach notification ends being useful. Warner Music didn't list the stores where the malicious code was injected, meaning regular shoppers wouldn't be able to tell if they were impacted or not.

Since the company manages tens of smaller music studios, it is unclear which of these were affected.

Warner Music is now offering free credit monitoring through Kroll — details included in the notification letter linked above.