MarineMax data breach affects over 123,000 customers and employees

MarineMax, an American recreational boat and yacht retailer, says that a data breach, which happened last March, has impacted 123,494 individuals.

In a 8-K Filing addressed to the Securities and Exchange Commission (SEC) dated March 12, the company wrote that a “cybersecurity incident” had occurred.

A third-party succeeded in gaining access to parts of the company’s IT environment and stole “limited data”, including personally identifiable customer and employee information of an undisclosed number of people.

Last Tuesday the boat and yacht retailer filed a data breach notice to the Office of the Maine Attorney General, saying the investigation that was launched after the security incident came to light was rounded up.

According to the security researchers, 123,494 people were affected by the data breach that was first discovered on March 10. The attackers gained access to “a limited number of systems” of the company’s internal network ten days earlier.

“Upon discovery of the incident, we remediated our environment, implemented additional security measures, initiated an investigation with the assistance of third-party forensic experts, and notified enforcement authorities. We also are notifying you so that you may take further steps to protect your information, should you feel it appropriate to do so,” the company says.

As of yet, MarineMax hasn’t disclosed what personal information has been stolen. Victims are offered 24 months of identity theft and fraud protection services.

On March 20 a hacking group called Rhysida claimed responsibility for the data theft. Since then, the threat actor has published 225 GB of data, or 204,510 digital files, they claim couldn’t be sold.

Rhysida uploaded a number of screenshots to the dark web, including driver’s licenses, copies of passports and financial documents of the company.