MARCH 2nd, 2018

Dear Valued Customer,

We are contacting you to notify you of a data breach which occurred between January 23rd, 2018 and February 26th, 2018, as well as on February 28th, on online stores owned and operated by NIS America, Inc., including store.nisamerica.com and snkonlinestore.com. This data breach allowed an unauthorized party to access customer payment and address information for new credit card orders placed between these dates.

Am I impacted by this?

This notice is intended to inform all customers of our online stores about what happened, even if they were not impacted by this issue.

If our information shows that you had placed an order between January 23rd, 2018 and February 26th, 2018 or on February 28th, you will have already received a message from us with details about these events. If you have not previously received a message from us, this means that we do not believe you have been compromised. If you are unsure if you have been compromised, you are welcome to contact us at storesupport@nisamerica.com for more details.

Even if you do not believe that you have been compromised, we recommend that you read this message so that you know how to protect yourself online.

IMPORTANT!

The malicious process used to collect personal information may still remain in your computer’s local files if you attempted to check out of one of our online stores between January 23rd, 2018 and February 26th, 2018, or on February 28th. Even though this process has been removed from our site, it may still be present in your local files. For your safety, we strongly recommend clearing your browser’s cookies, cached files, and other site data to ensure the deletion of these files. Even if you did not visit our site on these dates, we still recommend that you clear your data to ensure you are receiving up-to-date files from our web pages. Please see the following resources if you are unsure how to clear your browsing data -

Google Chrome-
https://support.google.com/accounts/answer/32050?co=GENIE.Platform%3DDesktop&hl=en

Mozilla Firefox-
https://support.mozilla.org/en-US/kb/clear-your-browsing-history-and-other-personal-data

Microsoft Edge-
https://support.microsoft.com/en-us/help/10607/microsoft-edge-view-delete-browser-history

Microsoft Internet Explorer-
https://support.microsoft.com/en-us/help/17438/windows-internet-explorer-view-delete-browsing-history

Additionally, we recommend use of Google Chrome when browsing online. Chrome will present a red warning page that says “Deceptive site ahead” if a malicious process is attempting to redirect your personal information.

What happened between January 23rd, 2018 and February 26th, 2018?

On the morning of February 26th, we became aware of a malicious process that had attached itself to our checkout page. This process was being used as far back as January 23rd, 2018 to skim personal information provided by our customers during checkout after they placed an order at our store. The data breach was largely targeted at orders placed using a credit card to pay for their order. Customers placing new orders using PayPal were at risk to have their billing, shipping, and email address compromised. However, we do not have any information to show that PayPal login or payment information was impacted.

After entering their billing, shipping, and payment information, the customer would be temporarily redirected to an offsite web page not owned or operated by NIS America, Inc. This malicious process would record the information provided by the customer during the checkout process, including credit card information, billing address, shipping address, and email address. Afterward, the malicious process would return the customer to the NIS America store page to complete their transaction.

Customers that may have had their information compromised between these dates were sent an email informing them dated February 28th, 2018. If you did not receive an email on this date, it is because our records did not show that you were impacted.

What happened to orders placed on February 28th, 2018?

We discovered the issue on February 26th 2018, and took our stores offline until the problem was able to be fixed later that same day. After the issue was removed, the stores were returned back online.

On the afternoon of February 28th, 2018, we discovered that the malicious process was again active. We took our stores offline until the problem was able to be fixed later that same day.

Our information shows that we have been receiving persistent attention from the same group or individual who had implemented the malicious process in January 2018. The malicious process implemented on February 28th, 2018 was identical to the process implemented in January 2018. Although the online stores were free of this issue for the latter part of February 26th and all of February 27th, the malicious process was reintroduced by using an alternate method early in the morning of February 28th. This issue was identified and removed by late afternoon on February 28th. We are continually monitoring our online stores at this time to ensure that no malicious changes are able to be made.

Customers that may have had their information compromised between these dates were sent an email informing them dated March 1st, 2018. If you did not receive an email on this date, it is because our records did not show that you were impacted.

Who is impacted?

Customers that placed orders between January 23rd, 2018 and February 26th, 2018, or on February 28th, 2018, are at risk. The data breach was largely targeted at orders placed using a credit card to pay for their order. Personal information, including payment information, was taken directly from new orders placed using a credit card. Orders placed during this time using PayPal did not have payment information or PayPal login information skimmed by this process. Orders placed before this time were not impacted.

What information was involved?

The skimming process had access to all information provided by the customer during checkout, including their name, address, credit card number, expiration date and CVV security code, and email address. Customers who placed new orders using their PayPal account were redirected to this malicious process before signing into PayPal, so we do not believe that PayPal payment or login information was compromised in this event. After being sent to the malicious web page, the customers were returned to a secure PayPal login page.

We do not collect Social Security numbers, and there is no evidence that any payment or billing information provided prior to January 23rd, 2018 was compromised.

What actions were taken as a result of this issue?

Once we became aware of this issue, we immediately took our store pages offline to prevent any further breaches. After taking our store pages offline, we scanned all our processes to determine the exact point of entry, as well as determine when this change occurred on our online stores. We have taken steps to solve the issue that resulted in this breach, along with several other steps to improve our site’s security. We are continually monitoring our online stores to ensure that no malicious changes are able to be made.

What you can do to protect yourself online:

-We recommend all customers clear their local browsing data to ensure that no malicious files remain in your browser’s cache as a precaution. For more information, please see “IMPORTANT!” at the beginning of this message.

-NIS America will never ask you for your personal information, payment information, or password via email, unless contacted to do so by our customers via our customer support channels. Updated payment information is only collected through PayPal, using either an invoice or direct payment.

-If you encounter any warning messages from your web browser that you may be proceeding to an unsafe page on our site or any other site, stop what you are doing and contact the site’s operators.

-If you feel that any of your online accounts may have been compromised, change the account password and set up two-step authentication if available.

-Keep an eye out for fraudulent emails, texts, phone calls, or fake websites trying to get your personal information. Never give out private or personal information, including financial details, unless you can verify the identity of the person or organization contacting you. Don’t respond to texts or emails coming from a contact you don't recognize, and don’t click on any links they provide. Instead, if you need to check your account, type the site address you want to visit into your browser and securely log into your account.

We pledge to do our best to get this issue resolved, and prevent it from happening again. At this time, we can say that we have identified the issue, removed it from our website, and taken steps to prevent this issue from recurring, as well as added new security to our online stores. We are continually monitoring our online stores to ensure that no malicious changes are able to be made. We would not be reopening our online stores if we did not feel confident that they are a safe place to shop.

If you have any questions or concerns, please feel free to contact us and we would be happy to assist you in any way that we can. We can be reached anytime at storesupport@nisamerica.com.

We are determined to provide you with a safe and secure shopping experience going forward. We hope to see you on our online stores again soon.

Sincerely,

NISA Online Store team
storesupport@nisamerica.com