Digital publisher marketing platform Edelweiss was exposed to a phishing scam on March 4 that compromised the company’s Edelweiss+ email list. Subscribers received an email which appeared to be an invoice but was actually the result of a hack to the company’s Constant Contact e-mail database.
John Rubin, CEO for Above the Treeline, which owns Edelweiss, told PW, "We did have an unauthorized email go out from our Constant Contact account yesterday that we dealt with right away. We notified Constant Contact, added security and communicated with all of the customers that received the phishing email as soon as we were made aware of it."
According to a statement issued by the company and sent to all subscribers, the hack was discovered within an hour of the breach. “Your Edelweiss+ account and subscriptions were neither impacted nor changed,” the company told subscribers in the statement. “It is clear that the intruder used our account to contact you, but we have no reason to believe that any data was exported. In any event, Edelweiss does not store account information such as credit card information or passwords on Constant Contact.”
Subscribers who clicked the link in the email while it was active were still vulnerable to ransomware attacks on their own devices. The company assured users that up-to-date antivirus software would detect and prevent ransomware from being installed, and also provided instructions for manually removing any suspicious files.
Some users expressed concern over the company’s initial response to the breach, which was posted to Twitter but not immediately emailed. There was additional confusion about which of the company’s email communications had been hacked. The compromised email was sent soon after one which was not compromised, but which was sent accidentally, welcoming subscribers to Edelweiss+Analytics when they had not actually subscribed.
A subsidiary of Above the Treeline, Edelweiss provides digital catalog information and sales analysis tools to the nation's largest publishers. It is widely used by booksellers, librarians, reviewers, and publishing professionals. It is unclear how many users were affected by the breach.
Due to a digital security measure, an earlier version of this article incorrectly stated that a representative for Edelweiss did not respond to a request for comment, when a response had been furnished by the company, but had been blocked. A response from company CEO John Rubin has been added. This article may be updated.
