Oregon Zoo warned 117,000 online ticket buyers of payment card theft
- Organization
- Oregon Zoo
- Exploit
- Hacking
- Industry
- Zoos and Attractions
The Oregon Zoo in Portland warned people who had bought tickets on its website that their payment card details may have been stolen. The zoo said it discovered suspicious activity in its online ticketing service on June 26, 2024.
An investigation found that an unauthorized actor had been redirecting customer transactions away from the third party vendor that processed online ticket purchases. The redirection ran from December 20, 2023 until the day it was discovered, giving the attacker roughly six months in which to capture card details as customers entered them.
The information at risk included names, payment card numbers, CVV security codes and card expiration dates. Social Security numbers were not involved. Infosecurity Magazine reported that 117,815 people received notification letters, covering customers across multiple states.
The zoo decommissioned the compromised ticketing site and stood up a rebuilt, more secure payments portal. It notified federal law enforcement and state regulators, including filing a notice with the California Attorney General, and offered a year of free credit monitoring and identity protection. Customers who bought tickets during the affected period were advised to review their card statements and credit reports for unauthorized activity.