Green Bay Packers Report Online Store Breach

The Green Bay Packers organization has disclosed a data breach involving malicious code inserted on their Pro Shop website, compromising customer information. The breach, identified on October 23, 2024, affected transactions made between September 23 and October 23, 2024, using specific payment methods.

The Green Bay Packers, known for their iconic National Football League (NFL) team and strong followership, reflected by their 80,000-strong Lambeau Field capacity crowds, manage a retail platform for fans to purchase official merchandise. This breach highlights the risks associated with online retail operations, especially during high-traffic periods when many fans may have shopped for team gear.

Packers fans exposed

The Packers detected the unauthorized insertion of malicious code on their e-commerce website, packersproshop.com, which exposed sensitive checkout data. Immediate action was taken to disable payment functionality on the site and remove the malicious code. A forensic investigation completed on December 20, 2024, confirmed that the breach targeted a subset of payment methods. Purchases made using gift cards, Pro Shop accounts, PayPal, or Amazon Pay were unaffected.

Customers who made transactions using traditional credit card payments may have had the following information accessed or stolen by the threat actors:

• Full name
• Billing and shipping addresses
• Email address
• Credit card type, number, expiration date, and verification number

The organization collaborated with cybersecurity experts and their website hosting vendor to remediate the issue and strengthen security measures. Efforts included resetting credentials, patching vulnerabilities, and enhancing ongoing security protocols. To support affected individuals, the Packers are offering 36 months of complimentary identity protection and credit monitoring services through Experian IdentityWorks.

The Packers advise impacted individuals to enroll in the provided Experian credit monitoring service by April 30, 2025, regularly monitor bank accounts and credit reports for unauthorized activity, and consider placing fraud alerts or security freezes on credit files, if necessary.

As highlighted in this case, using digital payment methods instead of credit/debit cards to make purchases online is safer. An alternative option would be private virtual cards that have predetermined credit and wouldn’t expose the owner’s identity or incur additional costs if stolen.