Retail chain Hot Topic hit by new credential stuffing attacks

Hot Topic disclosed two waves of credential-stuffing attacks in November 2023 targeting Hot Topic Rewards accounts using credential lists from an unknown source; the incidents may have exposed customers' personal information and the last four digits of payment cards. The retailer engaged external cybersecurity experts, implemented bot-protection measures, and required notified customers to reset passwords, while investigators were unable to determine precisely which accounts, if any, were accessed by unauthorized parties.