Skip to main content
    Customer Support Vendor

    Best Buy Third-Party Chat Vendor Breach (2018)

    Breach Year

    2018

    Breach Type

    Customer Support Vendor

    TPRM Lesson

    Live chat is a payment-adjacent surface.

    What was the Best Buy Third-Party Chat Vendor Breach breach?

    The Best Buy 24/7.ai breach was a 2018 disclosure that Best Buy customers were exposed during the same 2017 compromise of vendor 24/7.ai's online chat software that hit Delta and Sears.

    On this page

    1. What Was It?
    2. What Happened?
    3. How Did It Happen Technically?
    4. Why This Was a TPRM Failure
    5. Business Impact
    6. Consequences
    7. What Most People Miss About This Breach
    8. Practical TPRM Lessons
    9. Technical Protection Checklist
    10. Final TPRM Takeaway
    11. FAQ
    12. Public Sources Reviewed

    Best Buy is the case that made retail treat live chat as a payment-adjacent surface.

    24/7.ai chat ran on bestbuy.com. When the vendor's script was compromised, Best Buy customer data was captured alongside Delta and Sears.

    Best Buy disclosed the incident in April 2018.

    What Was It?

    The Best Buy tenant view of the shared 24/7.ai chat vendor compromise.

    What Happened?

    Sept to Oct 2017. Vendor chat script modified to capture card data.

    April 2018. Best Buy disclosed and notified affected customers.

    How Did It Happen Technically?

    • Vendor JavaScript with DOM access to Best Buy payment pages was tampered with.
    • Best Buy had no client-side integrity monitoring.
    • Detection relied entirely on vendor disclosure.

    Why This Was a TPRM Failure

    • Chat classified as low risk. The vendor sat on payment pages without extra controls.
    • No SRI or CSP. Client-side changes could not be caught.
    • Shared vendor blast radius unmapped. Best Buy shared exposure with peers.

    Business Impact

    • Best Buy customers notified.
    • Litigation joined with Delta and Sears actions.
    • Retail-wide reassessment of chat vendors on checkout.

    Consequences

    Retailers began isolating chat from card capture and enforcing SRI on vendor JavaScript.

    What Most People Miss About This Breach

    Live chat is a payment-adjacent surface. If it can read the DOM, it can read the card.

    Practical TPRM Lessons

    1. Isolate chat from payment DOM.
    2. Enforce SRI and CSP on all vendor scripts.
    3. Contract for hours-scale vendor notification.
    4. Monitor vendor script content independently.
    5. Map shared-tenant blast radius.
    6. Deploy hosted card fields.
    7. Rehearse coordinated disclosure.
    8. Assume vendor compromise.

    Technical Protection Checklist

    A. Identity and Access. MFA on vendor deploy.

    B. SaaS and API Integrations. Chat isolated.

    C. Software Supply Chain. SRI enforced.

    D. File Transfer and Data Exchange. CSP allowlist.

    E. Data Protection. Hosted card fields.

    F. Vendor Incident Response. Contractual hours-scale notification.

    G. Fourth-Party Risk. Vendor sub-processors disclosed.

    H. Board and Executive Reporting. Client-side vendor risk quarterly.

    Final TPRM Takeaway

    "Live chat is payment-adjacent. Govern it that way."

    Frequently Asked Questions

    What was the Best Buy 24/7.ai breach?

    A 2018 disclosure of shared vendor compromise exposing Best Buy customers via 24/7.ai chat.

    Why is it considered a third-party breach?

    Best Buy was not compromised. The chat vendor was.

    How did it happen?

    Vendor chat JavaScript was modified to capture card data.

    What was exposed?

    Payment and personal data of affected Best Buy customers.

    What was the impact?

    Customer notification, litigation and industry rethink of chat vendors.

    What controls could have reduced the risk?

    SRI, CSP, hosted card fields and vendor script monitoring.

    What should TPRM teams learn?

    Chat vendors on payment pages are payment vendors.

    What is the biggest lesson?

    If a vendor script can read the card, it is a card processor.

    Public Sources Reviewed

    All claims in this case study are grounded in verified public reporting.

    Back to All Case StudiesExplore the Free TPRM Platform

    TPRM Blog

    Related TPRM analysis from the blog

    Continue learning with the latest breach alerts, regulatory updates, and analyst playbooks from blog.learntprm.com.

    Visit blog.learntprm.com
    Safe Security - founding sponsor of LearnTPRM.comFounding Sponsor
    For CISOs, TPRM leads and vendor risk program owners

    Autonomous TPRM. 90% less manual effort.

    Almost every case here was findable before it happened

    Read enough third-party breaches and the pattern is brutal: an undisclosed fourth party, an expired certification, an exposure that sat on the internet for weeks. Nobody was lazy - the signals simply arrive faster than a human review cycle. The SAFE TPRM AI Co-Worker watches for them continuously.

    This is for you if you own a third-party risk program - roughly 100+ vendors, quarterly reassessments, DORA / NIS2 / OCC pressure and no new headcount coming. The link opens Safe Security's platform page, not a gated form.

    Five correlated data dimensions per vendor, refreshed continuously across the whole portfolio.

    Zero-touch due diligenceContinuous monitoring across 5 dimensionsAI-powered risk scoring workflows
    • The Fourth-Party Discovery agent finds the undisclosed downstream provider before it becomes your incident.
    • The Outside-In agent detects new vulnerabilities, misconfigurations and breaches as they surface.
    • The Threat Intel agent tracks leaked credentials, filings and legal events per vendor.
    Evaluate SAFE for my organization

    For security and risk leaders assessing a TPRM platform. Opens safe.security in a new tab.

    25+

    AI agents

    90%

    Less manual effort

    None

    Additional headcount

    200+

    Organizations globally

    End to end

    Intake to offboarding

    Just here to learn? Read how Safe Security sponsors LearnTPRM

    Ready to Prove You're a TPRM Warrior?

    Most people talk about risk management. Few can prove their expertise under pressure.

    Start Your Free Certification