Skip to main content
    Customer Support Vendor

    Sears 24/7.ai Customer Support Vendor Breach (2018)

    Breach Year

    2018

    Breach Type

    Customer Support Vendor

    TPRM Lesson

    Shared support vendors create shared breach events.

    What was the Sears 24/7.ai Customer Support Vendor Breach breach?

    The Sears 24/7.ai breach was a 2018 disclosure that around 100,000 Sears customers had payment data captured during the same September to October 2017 compromise of vendor 24/7.ai's chat software that also exposed Delta and Best Buy.

    On this page

    1. What Was It?
    2. What Happened?
    3. How Did It Happen Technically?
    4. Why This Was a TPRM Failure
    5. Business Impact
    6. Consequences
    7. What Most People Miss About This Breach
    8. Practical TPRM Lessons
    9. Technical Protection Checklist
    10. Final TPRM Takeaway
    11. FAQ
    12. Public Sources Reviewed

    Sears is the case that showed shared support vendors mean shared breach events.

    The same 24/7.ai chat software that ran on delta.com also ran on sears.com and kmart.com. When the vendor was compromised, Sears got the same skimmer.

    Sears disclosed the incident in April 2018 alongside Delta, notifying around 100,000 customers.

    What Was It?

    The Sears face of a shared multi-tenant SaaS breach at 24/7.ai.

    What Happened?

    Sept to Oct 2017. Malicious code inside 24/7.ai chat captured card data.

    April 2018. Sears publicly disclosed and notified around 100,000 customers.

    How Did It Happen Technically?

    • Vendor chat JavaScript modified to skim card data from the DOM.
    • Script loaded on Sears payment pages with no SRI or CSP.
    • Detection required the vendor to disclose to all tenants.

    Why This Was a TPRM Failure

    • Shared vendor risk unmapped. Sears did not know how many peer brands ran the same script.
    • No client-side integrity control. Sears could not detect the change independently.
    • Contract lacked shared-tenant disclosure. Notification timing was set by the vendor.

    Business Impact

    • Around 100,000 Sears customers notified.
    • Litigation joined to the Delta actions.
    • Retail-wide reassessment of chat vendors on payment pages.

    Consequences

    The case reinforced that multi-tenant SaaS vendors need tenant-scoped notification and independent client-side monitoring.

    What Most People Miss About This Breach

    Sears and Delta learnt about the incident on the vendor's timeline, not their own.

    Practical TPRM Lessons

    1. Enumerate every shared SaaS on payment pages.
    2. Deploy CSP and SRI on all vendor scripts.
    3. Contract per-tenant notification windows in hours.
    4. Isolate card fields from chat DOM.
    5. Monitor vendor script changes independently.
    6. Rehearse coordinated multi-brand disclosure.
    7. Include shared-SaaS blast radius in tiering.
    8. Assume the vendor is compromised.

    Technical Protection Checklist

    A. Identity and Access. MFA on vendor deploy pipeline.

    B. SaaS and API Integrations. Chat script isolated from card DOM.

    C. Software Supply Chain. SRI required.

    D. File Transfer and Data Exchange. CSP allowlist.

    E. Data Protection. Hosted card fields.

    F. Vendor Incident Response. Hours-scale notification.

    G. Fourth-Party Risk. Peer-tenant exposure disclosed.

    H. Board and Executive Reporting. Shared SaaS risk quarterly.

    Final TPRM Takeaway

    "When you share a vendor, you share the breach."

    Frequently Asked Questions

    What was the Sears 24/7.ai breach?

    A 2018 disclosure of a shared vendor compromise that exposed around 100,000 Sears customers.

    Why is it considered a third-party breach?

    The compromised software was operated by 24/7.ai, not Sears.

    How did it happen?

    Attackers modified vendor chat JavaScript to capture card data from the payment page.

    What was exposed?

    Payment card data of around 100,000 Sears customers.

    What was the impact?

    Notification of affected customers and joined litigation with Delta.

    What controls could have reduced the risk?

    SRI, CSP and isolated card capture.

    What should TPRM teams learn?

    Shared SaaS risk needs to be mapped and tiered.

    What is the biggest lesson?

    Peer tenants are your blast radius.

    Public Sources Reviewed

    All claims in this case study are grounded in verified public reporting.

    Back to All Case StudiesExplore the Free TPRM Platform

    TPRM Blog

    Related TPRM analysis from the blog

    Continue learning with the latest breach alerts, regulatory updates, and analyst playbooks from blog.learntprm.com.

    Visit blog.learntprm.com
    Safe Security - founding sponsor of LearnTPRM.comFounding Sponsor
    For CISOs, TPRM leads and vendor risk program owners

    Autonomous TPRM. 90% less manual effort.

    Almost every case here was findable before it happened

    Read enough third-party breaches and the pattern is brutal: an undisclosed fourth party, an expired certification, an exposure that sat on the internet for weeks. Nobody was lazy - the signals simply arrive faster than a human review cycle. The SAFE TPRM AI Co-Worker watches for them continuously.

    This is for you if you own a third-party risk program - roughly 100+ vendors, quarterly reassessments, DORA / NIS2 / OCC pressure and no new headcount coming. The link opens Safe Security's platform page, not a gated form.

    Five correlated data dimensions per vendor, refreshed continuously across the whole portfolio.

    Zero-touch due diligenceContinuous monitoring across 5 dimensionsAI-powered risk scoring workflows
    • The Fourth-Party Discovery agent finds the undisclosed downstream provider before it becomes your incident.
    • The Outside-In agent detects new vulnerabilities, misconfigurations and breaches as they surface.
    • The Threat Intel agent tracks leaked credentials, filings and legal events per vendor.
    Evaluate SAFE for my organization

    For security and risk leaders assessing a TPRM platform. Opens safe.security in a new tab.

    25+

    AI agents

    90%

    Less manual effort

    None

    Additional headcount

    200+

    Organizations globally

    End to end

    Intake to offboarding

    Just here to learn? Read how Safe Security sponsors LearnTPRM

    Ready to Prove You're a TPRM Warrior?

    Most people talk about risk management. Few can prove their expertise under pressure.

    Start Your Free Certification