Advance Auto Parts says Snowflake security incident impacted over 2.3m customers

American automotive aftermarket parts provider Advance Auto Parts said the data breach it suffered in May compromised the sensitive personal information of more than 2.3 million people.

 

In a data breach notice filed with the Office of Maine Attorney General, Advance said that on May 23, it became aware that Snowflake, its cloud storage and data warehousing vendor, was a victim of a data security incident.

 

Advance immediately launched an investigation, with assistance from external cyber security experts, to determine the impact of the Snowflake incident on its systems. It also took steps to contain the incident and notified law enforcement.

 

“Our investigation determined that an unauthorised third party accessed or copied certain information maintained by Advance Auto Parts from April 14, 2024 to May 24, 2024,” Advance said. 

 

“We conducted a detailed review and analysis of the affected information to determine the types of information contained therein and to whom the information relates. This review was completed on June 10, 2024.”

 

It said the security incident compromised customer data, including customers’ names, dates of birth, Social Security numbers, driver’s license and other government issued identification numbers. The company’s filing with the state regulator also revealed that at least 2,316,591 individuals were impacted by the incident.

 

“Upon learning of the incident, we promptly terminated the unauthorised access and took proactive measures aimed at preventing future unauthorised access.

 

“In addition, we continue to work with third-party cybersecurity experts to take steps to further harden our systems and emerge from this incident an even more secure organisation,” the company added.

 

The company has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general. It has also offered one year of complimentary identity protection and credit monitoring services through Experian IdentityWorks to all affected individuals.