UK Shelly reseller warns payment data stolen after malware found on website

Customer says they received fraudulent charges on their card hours before company notified them

A UK-based reseller of Shelly smart home equipment has warned customers that their payment data may be compromised after “unauthorized software” was found on its website.

“After receiving a warning from our payment provider, Stripe, we investigated and found unauthorized software on our website and server,” the email from Shelly Store UK, seen by The Register, stated.

“We removed the identified malicious software, strengthened access security, applied security updates and introduced ongoing monitoring. We have also reported the incident to the Information Commissioner’s Office.”

REG AD

Shelly Store UK informed customers it was unable to determine whether their data was accessed or copied, although all customers who made orders during an unspecified window are being contacted.

REG AD

One punter told us that hours before they received the email from Shelly Store UK,  they began a payment dispute with their card provider after a £221.28 transaction, dated October 26, was made in Australia using their details.

They suspect their full card details were swiped at some point between October 12, when they made their first and only order with the company, and October 27, when they received the breach notification. 

Shelly Store UK did not immediately respond to our request for more details.

Its notification email stated the internal investigation remains ongoing, and in addition to payment card details, customers may have had their names, billing addresses, and contact details compromised.

Shelly Store UK recommended that customers contact their card issuer for guidance on whether they will need a replacement card, and to scour their transaction histories and report any suspicious entries.

It also urged caution in receiving communications asking for data such as payment details and security codes, and recommended a password reset.

“We’re sorry for the concern and inconvenience this may cause,” the company said. “We are taking this seriously and will contact you if our investigation identifies further information relevant to you.”

Shelly Store UK is an authorized reseller of Shelly smart home products and is wholly independent of the main Shelly company. 

REG AD

“Shelly Store is a reseller of Shelly and is not part of, owned by, or directly affiliated with Shelly Group,” a Shelly spokesperson said. “We do not manage the Shelly Store website, its business operations, and we do not direct our customers from any of our websites to Shelly Store UK.” ®