Goodwill discloses a data breach on its ShopGoodwill platform

Picture: Peter Ryan

US-based non-profit organization Goodwill disclosed a data breach that affected the accounts of customers using its ShopGoodwill.com e-commerce auction platform.

ShopGoodwill Vice President Ryan Smith said in data breach notification letters sent to affected individuals that some of their personal contact information was exposed due to a vulnerability in the site.

Smith added that no payment information was exposed in the incident because ShopGoodwill does not store this data on its servers.

“We were recently alerted to an issue on our website which resulted in the exposure of some of your personal contact information to an unauthorized third party. This contact information includes your first and last name, email address , your phone number and mailing address. Smith explained.

“No payment card information was exposed; ShopGoodwill does not store payment card information. Although the third party accessed the buyer’s contact information, they did not access your ShopGoodwill account.”

The nonprofit organization patched the ShopGoodwill vulnerability that resulted in exposure to personal contact information.

“ShopGoodwill is committed to ensuring the security of your personal information and we apologize for any frustration or concern this incident may cause,” Smith added.

“If we become aware of additional relevant information, we will contact you immediately. If you have a question that has not been addressed in this communication, please email [email protected].”

Goodwill served more than 25 million people with disabilities or disadvantages worldwide in 2019 and helped more than 230,000 people train for jobs in banking, IT and healthcare.

The non-profit organization funds itself by selling donated clothing and household items through an extensive network of thousands of thrift stores around the world and through its online auction site ShopGoodwill.com.

A spokesperson for Goodwill was unavailable for comment when contacted by BleepingComputer earlier today.