MarineMax says March ransomware attack impacted over 120,000 customers

Yacht retailer MarineMax said that the data security incident it suffered earlier this year compromised the sensitive personal information of more than 120,000 individuals.

 

MarineMax, a one-stop-shop for all things related to boating, said in a filing with the U.S Department of Securities and Exchange Commission that on March 10, it identified a cyber security incident that involved an unauthorised third party gaining access to portions of its internal network.

 

The company immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident. The investigation revealed that the threat actor, who infiltrated its network, accessed and stole sensitive personal information of its clients.

 

The compromised data included customers’ names and other personal identifiers. MarineMax said in its filing with the Maine state regulator that at least 123,494 individuals were impacted by the incident.

 

Upon discovery of the incident, MarineMax took steps to secure its internal network and implemented additional security measures to avoid such incidents in the future.

 

While MarineMax found no evidence of the compromised information being misused, it advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general.

 

It has also offered two years of complimentary identity protection and credit monitoring services through Experian to all affected individuals.

 

The infamous Rhysida ransomware group claimed responsibility for the cyber attack on MarineMax and listed the company as a victim on its data leak site. The group claimed to be in possession of several gigabytes of stolen data and demanded a ransom of 15 bitcoins, or about £740,000.