Petco confirms security lapse exposed customers’ personal data

Petco, a leading provider of pet products and services, has reported a significant data security incident that has potentially compromised customer information. This disclosure was made in a recent filing to the California attorney general, where the company acknowledged that certain personal details of its customers were exposed. In the notification letter shared by the state, Petco explained that a misconfiguration in one of its software applications inadvertently made specific files accessible online. The company claimed to have identified this vulnerability independently and acted swiftly to rectify it, ensuring the files were no longer available online. However, the letter did not clarify the exact nature of the personal data that was exposed during this breach. A spokesperson for Petco, Ventura Olvera, indicated to TechCrunch that the company has communicated additional information to those individuals whose data may have been compromised. Nonetheless, Olvera did not address follow-up inquiries about the number of customers impacted or the specific types of personal information involved. California law mandates reporting of data breaches affecting 500 or more residents, implying that at least 500 Petco customers in California are likely affected. The company has also reached out to a number of individuals in Massachusetts and a few in Montana, as noted on the state’s official website. As a precautionary measure, Petco is offering victims complimentary credit and identity theft monitoring services. In compliance with California regulations, the company is obligated to provide support to credit monitoring agencies if sensitive information such as driver's license or Social Security numbers is compromised. In its letter to customers, Petco reassured them that it has corrected the application settings that led to the breach, and has instituted several unspecified security enhancements to bolster the protection of its applications.