A network of knockoff apparel stores exposed 330,000 customer credit cards
If you recently made a purchase from an overseas online store selling knockoff clothes and goods, there’s a chance your credit card number and personal information were exposed.
Since January 6, a database containing hundreds of thousands of unencrypted credit card numbers and corresponding cardholders’ information was spilling onto the open web. At the time it was pulled offline on Tuesday, the database had about 330,000 credit card numbers, cardholder names, and full billing addresses — and rising in real-time as customers placed new orders. The data contained all the information that a criminal would need to make fraudulent transactions and purchases using a cardholder’s information.
The credit card numbers belong to customers who made purchases through a network of near-identical online stores claiming to sell designer goods and apparel. But the stores had the same security problem in common: any time a customer made a purchase, their credit card data and billing information was saved in a database, which was left exposed to the internet without a password. Anyone who knew the IP address of the database could access reams of unencrypted financial data.
Anurag Sen, a good-faith security researcher, found the exposed credit card records and asked TechCrunch for help in reporting it to its owner. Sen has a respectable track record of scanning the internet looking for exposed servers and inadvertently published data, and reporting it to companies to get their systems secured.
But in this case, Sen wasn’t the first person to discover the spilling data. According to a ransom note left behind on the exposed database, someone else had found the spilling data and, instead of trying to identify the owner and responsibly reporting the spill, the unnamed person instead claimed to have taken a copy of the entire database’s contents of credit card data and would return it in exchange for a small sum of cryptocurrency.
A review of the data by TechCrunch shows most of the credit card numbers are owned by cardholders in the United States. Several people we contacted confirmed that their exposed credit card data was accurate.
TechCrunch has identified several online stores whose customers’ information was exposed by the leaky database. Many of the stores claim to operate out of Hong Kong. Some of the stores are designed to sound similar to big-name brands, like Sprayground, but whose websites have no discernible contact information, typos and spelling mistakes, and a conspicuous lack of customer reviews. Internet records also show the websites were set up in the past few weeks.
Some of these websites include:
If you bought something from one of those sites in the past few weeks, you might want to consider your banking card compromised and contact your bank or card provider.
It’s not clear who is responsible for this network of knockoff stores. TechCrunch contacted a person via WhatsApp whose Singapore-registered phone number was listed as the point of contact on several of the online stores. It’s not clear if the contact number listed is even involved with the stores, given one of the websites listed its location as a Chick-fil-A restaurant in Houston, Texas.
Internet records showed that the database was operated by a customer of Tencent, whose cloud services were used to host the database. TechCrunch contacted Tencent about its customer’s database leaking credit card information, and the company responded quickly. The customer’s database went offline a short time later.
“When we learned of the incident, we immediately contacted the customer who operates the database and it was shut down immediately. Data privacy and security are top priorities at Tencent. We will continue to work with our customers to ensure they maintain their databases in a safe and secure manner,” said Carrie Fan, global communications director at Tencent.
Tesla brings back European referral program as end of Q1 nears
Tesla is bringing back its referral program to Europe, a strategy that taps into the brand loyalty of customers as it seeks to preserve market share and boost sales before the first quarter of 2023 closes.
The referral program follows Tesla’s move to reduce prices in a variety of markets, including Europe, China and North America.
Starting Tuesday in Europe, new Tesla buyers can receive 100 so-called “Loot Box Credits” when referred by a current Tesla owner, who will get 2,000 credits for the referral. If the referred customer takes delivery before March 31, 2023, they’ll get a bonus of 5,000 free Supercharging kilometres, and the referrer will get 10,000 credits. Those credits can be redeemed for software upgrades, up to 10,000 kilometers of free Supercharging “and more.”
Tesla has never used traditional advertising, so the company has historically used its referral program to get its loyal customer base to promote vehicles. Those rewards have changed over the last few years. At certain points, owners could win rewards like having a photo of their choosing launched into deep space orbit, an invite to an upcoming Tesla event, or even free new Roadsters to owners who accumulated enough referrals.
Tesla realized such extravagant rewards were starting to eat into profits, so in 2019 the automaker paused the program and came back with a more reasonable one that gives the referral giver and receiver 1,000 miles of free Supercharging each.
Last November, Tesla launched a revamped referral program in the U.S., which gives out credits that can be put towards the purchase of Tesla solar products, like the Solar Roof and Solar Panels. Tesla also launched a program in China called Treasure Box, where owners get credits that can be used towards the purchase of accessories like vehicle chargers, t-shirts or shot glasses.
The move in Europe suggests that Tesla is trying to hold onto, or even grow, its market share dominance. Tesla was the most popular EV brand in Europe last year, with the Model Y and Model 3 topping the ranks at 138,373 and 91,257 sales, respectively. Following behind were the Volkswagen ID.4 with 68,409 unit sales, the Fiat 500 electric with 66,732, and the Ford Kuga plug-in hybrid EV with 55,018 sales, according to Inside EVs.
While Tesla was the most popular EV brand in Europe last year, it actually falls behind the large multi-brand OEMs. Volkswagen Group, which includes brands like Audi and VW, actually has the largest market share of plug-in EVs with 20.6%. Stellantis, BMW Group and Hyundai follow with 14.6%, 10.5% and 10.1%, respectively. Mercedes and Tesla are tied at around 9% share.
As of this week, Tesla has finally hit production capacity of 5,000 vehicles per week at its Berlin gigafactory — a milestone CEO Elon Musk had originally promised for the end of 2022. While production numbers don’t equal sales, it’s possible that the increased production in Europe could help the automaker maintain its position and gain even more market share in the future.
The referral program isn’t the only move Tesla has made to boost sales, particularly before it reports quarterly earnings. In January, Tesla cut prices for Model 3 and Model Y vehicles in the U.S. and Europe by 20%. Earlier this month, the automaker slashed Model S and Model X prices in the U.S. as well.
In December 2022, Tesla also provided up to $7,500 discounts for vehicles purchased and delivered before the end of the year in the hopes of attracting buyers who might otherwise wait for the new year when Inflation Reduction Act incentives would kick in.
Pinterest brings shopping capabilities to Shuffles, its collage-making app
Pinterest announced today that it’s testing ways to integrate Shuffles collage content into Pinterest, starting with shopping. Shuffles, which is Pinterest’s collage-making app, launched to general public last November. To use Shuffles, users build collages using Pinterest’s own photo library or by snapping photos of objects they want to include with their iPhone’s camera. The iOS-only app is available in the U.S., Canada, Great Britain, Ireland, Australia and New Zealand.
Shuffles will now have all of the shopping capabilities as regular pins. Users will be able to tap individual cutouts used in collages, see the brand, price, and other product metadata along with similar products to shop.
“Unlike typical product exploration, Shuffles bring an interactivity that makes the experience inspirational and fun,” the company said in a blog post. “Gen-Z is curating fresh, relevant content alongside their peers, which is quickly making for a marketplace of trendy, shoppable ideas. The high density nature of Shuffles, which can include layers of product cutouts from multiple Pins, allows consumers to dig deeper and also connect to other Shuffles that include the same Pins. As we look ahead to how consumer behavior is evolving, we’re testing ways of integrating Shuffles collage content into Pinterest, starting with shopping.”
Although Shuffles surged to become the No. 1 Lifestyle app on the U.S. App Store in August when it was invite-only, the app’s popularity has since declined. By bringing shopping capabilities to Shuffles, Pinterest is likely looking for ways to retain users on the standalone app.
Pinterest also announced that it’s exploring a new takeover feature for advertisers called “Pinterest Premiere Spotlight” that prominently showcases a brand on search. The company says the feature is designed give advertisers a new way to reach users on Pinterest.
The company says 97% of top searches on Pinterest are unbranded, which means users typically don’t type a brand name into their searches on the platform. This gives brands the opportunity to be discovered as they help consumers go from discovery to decision to purchase, Pinterest says. In the coming months, the company planes to offer additional ways to help brands connect with shoppers.
Pinterest also shared some new stats about its Catalogs offering, which lets brands upload their full catalog to the platform and turn their products into dynamic Product Pins. The company says it has seen a 66% increase in retailers setting up shop by uploading or integrating their digital catalogs on its platform, along with 70% growth in active shopping feeds year over year globally.
As part of its most recent earnings release, Pinterest revealed that its platform now has 450 million monthly active users globally, a 4% jump year-on-year. Pinterest has been focused on enhancing the shopping experience on its platform over the past few years, and said during its earnings call that it wants to make every pin shoppable, including videos.
The tide has shifted for solo GPs
Welcome to Startups Weekly, a nuanced take on this week’s startup news and trends by Senior Reporter and Equity co-host Natasha Mascarenhas. To get this in your inbox, subscribe here.
It’s hard to be proactive after the tide has already shifted. However, that’s what we’re seeing happen in the solo GP world, where investors, hearing about institutional investor risk appetite changing, are extending fundraising timelines, cutting investment vehicle targets or planning to leave venture altogether. Some have learned it the hard way, while others, like Sahil Lavingia, are telling LPs to literally cancel their checks if they feel guilty about investing in venture capital while the market rocks and interest rates boom.
It’s a shift from the fund of fund mentality that felt commonplace last year, in which investment firms cut checks to early-stage, experimental investors to de-risk and even lead first checks into a generation of new startups. Now, the idea of backing just one, feels like a harder sell — depending on which institution you’re speaking to.
For my full take on this burgeoning tension within the venture world read my TC+ column: “Are solo GPs screwed?”
I know some of us are still reeling from the SVB mess, which is still very much unfolding. My hope with this piece is to offer nuance on how the market moves on from here for a very specific subset of check writers. In other words, yes, there’s a dreary dark cloud that is now more visible than before. But umbrellas exist. Somewhere.
In the rest of this newsletter we’re talking AI, icons and demo days. As always, you can follow me on Twitter or Instagram to continue the conversation. You can also send me tips at email@example.com or on Signal at +1 925 271 0912. No pitches, please.
It’s never GM; it’s only AI
Now that I apparently live in Cerebral Valley, it’s quite easy to find investors, founders or my great friends in the middle of a passionate conversation about artificial intelligence. Heck, we even screencast ChatGPT trying to explain SVB during wine night, recently.
Despite the overactive news scene, thanks to ChatGPT plug-ins, Google’s entrance and Canva’s magic, the best piece I read all week came from our own Devin Coldeway. In this analysis, Coldeway published a head-to-head comparison of top generative AI tools — asking them to create everything from a phishing email to code.
Here’s what to know: In the AI world, the compounding effect is almost impossible to encapsulate. Tech keeps beating itself, and advancement is only to be celebrated with a grain of hopeful salt. But, see it yourself if you don’t believe me!
Overheard at Techstars’ demo day
I went to an in-person demo day for the first time since 2019 this week, courtesy of 500 Global. There was a special, earnest energy in the room, partially because, as 500’s CEO Christine Tsai said, the 19 companies are sharing their vision for the future “around one of the darkest backdrops of Silicon Valley.” More to come on specific learnings, but below I thought I’d bullet point some of the tidbits I overheard while at the accelerator’s pitch session.
- “I find it very insightful to compare your revenue growth with your team growth — I personally don’t like operations-heavy companies, I definitely want to see more investment in the R&D and product [teams],” Cindy BI, partner at CapitalX.
- “We’re officially teenagers,” Tsai said on the accelerator’s 13th birthday.
- “When you think of a brand, you probably think of something like Nike. But to Gen Z, some of the biggest brands are people,” Detoure founder and CEO Meghan Russell.
- “We know how to get exits done,” Peter Wachira, CEO of Tripitaca, later adding, “We know how to get shit done.”
One of venture’s most iconic duos wants to have a word with you
I published a podcast interview with Kapor Capital’s Freada Kapor Klein and Mitch Kapor, the entrepreneurial investing couple behind the top-tier impact investing outfit. The duo published a book recently, so we talk about that, their choice to step away from investing and the legacy they’re continuing to build out.
Here’s one key moment from the podcast: “It’s also worth pointing out, in the early days, there were a couple of people, white men, who were thinking about working with us and decided we weren’t going to make enough money so they went elsewhere. So I hope they’re kicking themselves and I hope they’ve learned something,” said Kapor Klein.
- I was on comedian Alexis Gay’s podcast, Non-technical, earlier this month to talk about everything other than my day job. Come for the croissant hate; stay for the devil’s advocate advocacy.
- Also, listen to Found, a podcast about the stories behind the startups. This week, the team published an interview with the brains behind “a genetics startup that looks to bring extinct species back to life to help with environmental conservation efforts.” Jaw = dropped.
Seen on TechCrunch
Startup says the seaweed blobbing toward Florida has a silver lining
Hivemapper is 1M kilometers closer to goal of beating Google Maps
Twitter will kill ‘legacy’ blue checks on April 1
China reminds US that it can and will kill a forced TikTok sale
Seen on TechCrunch+
Threading the needle: Exploring 5 ideas with the founders of LGBT+ VC
Investors want best-of-the-best ESG data. Here’s how to give it to them
As TikTok and Coinbase face regulators, some questions are simpler than others
Pitch Deck Teardown: Prelaunch.com’s $1.5M seed deck
How Fellow bootstrapped for 8 years to build a coffee empire
Interviews1 year ago
Interview with Jean-Francois Desormeaux, Real Estate Investor
Business News10 months ago
NFTMagazine.com Is Bringing NFTMag Conference 2022 to Miami this Year Says JetSetFly
Technology6 months ago
General Atlantic buys out SoftBank’s 15% stake in edtech Kahoot, now valued at about $152M vs the $215M SoftBank ponied up 2 years ago
Interviews12 months ago
Paying it Forward — Meet Dr. Jonathan Kenigson, the Founder of the World’s Leading Think-Tank in the Quadrivium
Interviews4 months ago
Interview with Justice Mitchell, A 16-year-old Student-Athlete Who Received a Basketball Scholarship Offer from Pennsylvania University Greater Allegheny
Entrepreneurship1 year ago
600% In Under 5 Years, Financial Advisors Grow Business By Podcasting And YouTube
Entrepreneurship1 year ago
Muminovic Benjamin E-commerce on Shopify the Course of the Business Man
Community9 months ago
The Bassnectar Community – It Belongs to All of Us