{"id":224800,"date":"2025-12-12T10:03:23","date_gmt":"2025-12-12T18:03:23","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=224800"},"modified":"2025-12-12T10:03:23","modified_gmt":"2025-12-12T18:03:23","slug":"petco-data-breach-was-i-compromised","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/security-news\/petco-data-breach-was-i-compromised\/","title":{"rendered":"This Week in Scams: Petco Breach Warning, and Watch Out for Fake Federal Calls"},"content":{"rendered":"

Pets, poisoned AI search results, and a phone call that sounds like it\u2019s coming straight from the federal government, this week\u2019s scams don\u2019t have much in common except one thing: they\u2019re getting harder to spot.<\/p>\n

In today\u2019s edition of This Week in Scams<\/em>, we\u2019re breaking down the biggest security lapses and the tactics scammers used to exploit them, and what you can do to stay ahead of the latest threats.<\/p>\n

Two data security lapses discovered at Petco in one week put pet parents at risk<\/strong><\/h2>\n

If you\u2019re a Petco customer, you\u2019ll want to know about not one but two data security lapses in the past week.<\/p>\n

First, as reported by TechCrunch on Monday<\/a>, Petco followed Texas data privacy laws by filing a data breach with the attorney general\u2019s office. In that filing, Petco reported that the affected data included names, Social Security numbers, and driver\u2019s license numbers.<\/strong> Further info including account numbers, credit and debit card numbers, and dates of birth were also mentioned in the filing.<\/p>\n

Also according to Techcrunch, the company filed similar notices in California and Massachusetts.<\/p>\n

To date, Petco has not made a comment about the size of the breach and the number of people affected.<\/p>\n

Different states have different policies for reporting data breaches. In some cases, that helps us put a figure to the size of the breach, as some states require companies to disclose the total number of people caught up in the breach. That\u2019s not the case here, so the full scope of the attack remains in question, at least for right now.<\/p>\n

As of Thursday, we know Petco reported that 329 Texans were affected along with seven Massachusetts residents, per the respective<\/a> reports filed<\/a>. California\u2019s report does not contain the number of Californians affected, yet laws in that state require businesses to report breaches that affect 500 or more people, so at least 500 people were affected there.<\/p>\n

Below you can see the form letter Petco sent to affected Californians in accordance with California\u2019s data privacy laws:<\/p>\n

\"Copy
Copy of the form letter posted on the California Attorney General\u2019s Website<\/figcaption><\/figure>\n

 <\/p>\n

In it, you can see that Petco discovered that \u201ca setting within one of our software applications \u2026 inadvertently allowed certain files to become accessible online.\u201d Further, Petco said that it \u201cimmediately took steps to correct the issue and to remove the files from further online access,\u201d and that it \u201ccorrected\u201d the setting and implemented unspecified \u201cadditional security measures.\u201d<\/p>\n

So while no foul play appears to have been behind the breach, it\u2019s still no less risky and concerning for Petco\u2019s customers. We\u2019ll cover what you can do about that in a moment after we cover yet another data issue at Petco through its Vetco clinics.<\/p>\n

Also within the same timeframe, yet more research and reporting from Techcrunch uncovered a second security lapse that exposed personal info online. From their article:<\/p>\n

\u201cTechCrunch identified a vulnerability in how Vetco\u2019s website generates copies of PDF documents for its customers.<\/p>\n

\u201cVetco\u2019s customer portal, located at\u00a0petpass.com, allows customers to log in and obtain veterinary records and other documents relating to their pet\u2019s care. But TechCrunch found that the PDF generating page on Vetco\u2019s website was public and not protected with a password.<\/p>\n

\u201cAs such, it was possible for anyone on the internet to access sensitive customer files directly from Vetco\u2019s servers by modifying the web address to input a customer\u2019s unique identification number. Vetco customer numbers are sequential, which means one could access other customers\u2019 data simply by changing a customer number by one or two digits.\u201d<\/p>\n

What to do if you think you had info stolen in the Petco breach<\/strong><\/h2>\n

With the size and reach of the Petco breach still unknown, and the impact of the Vetco security lapse also unknown, we advise caution for all Petco customers. At minimum, monitor transactions and keep an eye on your credit report for any suspicious activity. And it\u2019s always a good time to update a weak password.<\/p>\n

For those who received a notification, we advise the following:<\/p>\n

Check your credit, consider a security freeze, and get ID theft protection.<\/strong> You can get all three working for you with McAfee+ Advanced or McAfee+ Ultimate<\/a>.<\/p>\n

Monitor transactions across your accounts, <\/strong>also available in McAfee+ Advanced and Ultimate<\/a>.<\/p>\n

Keep an eye out for phishing attacks. <\/strong>Use our Scam Detector<\/a> to spot any follow-on attacks.<\/p>\n

Update your passwords. <\/strong>Strong and unique passwords are best. Our password manager<\/a>\u00a0can help you create and store them securely.<\/p>\n

And use two-factor authentication on all your accounts.<\/strong> Enabling two-factor authentication provides an added layer of security.<\/p>\n

\"Image
Image Credit: Federal Register<\/figcaption><\/figure>\n

 <\/p>\n

What to do if your Social Security number was breached.<\/strong><\/p>\n

If you think your Social Security number was caught up in the breach, act quickly.<\/p>\n

    \n
  1. First, contact one of the three credit bureaus (Equifax, Experian, or TransUnion) and place a fraud alert on your credit report.<\/li>\n
  2. That will cover all three bureaus and make it harder for someone to open new accounts in your name. You can also quickly freeze your credit altogether with McAfee+ Ultimate<\/a>.<\/li>\n
  3. Also notify the Social Security Administration<\/a> (SSA) along with the Internal Revenue Service<\/a> (IRS), and file a police report immediately if you believe your number is being misused.<\/li>\n<\/ol>\n

    The call center number that connects you to \u2026 scammers?<\/strong><\/h2>\n

    You might want to be careful when searching for customer service numbers while in AI mode. Or with an AI search engine. It could connect you to a scammer.<\/p>\n

    From The Times<\/em> comes reports of scammers manipulating the AI in platforms like Google and Perplexity so that their search results return scam numbers<\/strong> instead of a proper customer service numbers for, say, British Airways.<\/p>\n

    How do they manipulate those results? By spamming the internet with false info that gets picked up and then amplified by AI.<\/p>\n

    \u201c[S]cammers have started seeding fake call center numbers on the web so the AI is tricked into thinking it is genuine \u2026<\/em><\/p>\n

    \u201cCriminals have set up YouTube channels with videos claiming to help with customer support, which are packed with airline brand names and scam numbers designed to be scraped and reused by the AI.<\/em><\/p>\n

    \u201cBot-generated reviews on Yelp or video descriptions on YouTube are filled with fraudulent numbers as are airline and travel web forums.\u201d<\/em><\/p><\/blockquote>\n

    And with these tactics, scammers could poison the results for just about any organization, business, or brand.<\/strong> Not just airlines. Per The Times<\/em>, \u201cThe scammers have also hijacked government sites, university domains, and even fitness sites to place scam numbers, which fools the AI into thinking they are genuine.\u201d<\/p>\n

    This reveals a current limitation with many AI platforms. Largely they can\u2019t distinguish when people deliberately feed them bad info, as seen in the case here.<\/p>\n

    Yet even as this attack is new, our advice remains the same: any time you want to ring up a customer service line, get the number directly from the company\u2019s official website.<\/strong> Not from AI search and not by clicking a paid search result that shows up first (scammers can poison them too).<\/p>\n

    Is that a call from an FTC \u201cagent?\u201d If so, it\u2019s a scam.<\/strong><\/h2>\n

    Are you under investigation for money laundering? Of course not. But this scam wants you to think so\u2014and to pay up.<\/p>\n

    On Tuesday, the Federal Trade Commission (FTC) issued a consumer alert warning that people are reporting getting unexpected calls from someone saying they\u2019re \u201cFTC agent\u201d John Krebs. Apparently \u201cAgent Krebs\u201d is telling people that they\u2019re under investigation for money laundering<\/strong>\u2014and that a deposit to a Bitcoin ATM can resolve the matter.<\/p>\n

    Of course, it\u2019s a scam.<\/p>\n

    For starters, the FTC doesn\u2019t have \u201cagents.\u201d<\/strong>\u00a0And the idea of clearing one\u2019s name in an investigation with a Bitcoin payment is a sure-fire sign of a scam. Lastly, any time someone asks for payment with Bitcoin or other payment methods that are near-impossible to recover (think wire transfers and gift cards), those are big red flags.<\/p>\n

    Apart from hanging up and holding on to your money, the FTC offers the following guidance, which holds true for any scam call:<\/p>\n