An intruder may have seen customers' names and emails at gift-box seller Smartbox

The email has a plain subject line: “Important information.” In it, Smartbox, the gift-box specialist, tells its customers it detected unauthorized access to one of its IT platforms on November 3. On November 7, Clubic, FrenchBreaches and Cyberattaque.org reported the content of the message.

According to the company, whose investigation is ongoing, the first names, last names and email addresses linked to customer accounts may have been viewed. Smartbox says, however, that the attacker “did not have access to bank details or account passwords,” in the wording quoted by Clubic. It says it has blocked the intruder's access and launched a review of the security of its systems.

What Smartbox is not saying yet

The message leaves many questions open. The company does not say how many customers are affected, which platform was targeted, how the intruder got in, or how long they stayed. It also does not say whether data was copied, and not just viewed. No hacker group has claimed the attack, according to Clubic, which relies on FrenchBreaches.

The geographic scope remains unclear. Smartbox sells its boxes in France, Belgium, Switzerland and other European countries, Clubic notes. The group also sells the Dakotabox, Cadeaubox and Bongo brands, and it is unknown whether their customers are affected. According to Clubic and FrenchBreaches, Smartbox also announces a new PIN code for its gift vouchers, without explaining how it works.

The company, which is incorporated under Irish law, says it has notified the police and the Irish Data Protection Commission, which leads the case for the European Union. French customers can also file a complaint with the CNIL (the French data protection authority).

An earlier episode raises questions. In June, Cyberattaque.org reported that data attributed to the company had been posted in a forum frequented by cybercriminals: more than 60,500 user accounts and 202,000 contract records, mostly tied to business partners. Smartbox has never confirmed this, and no link has been established with the November incident.

Why a name and an email address are enough for scammers

Without a password or bank card, the leak may look harmless. But a name, an email address and the certainty that the person is a Smartbox customer are enough to write a credible phishing message: a box to reactivate, a voucher about to expire, a booking to confirm. In the middle of gift season, this kind of message is likely to go unnoticed among the real ones.

Good habits to adopt

• Smartbox says it will “never” ask for your password or bank details by email: any message that does is a scam.
• Be wary of unexpected emails, text messages or calls about a gift box, a booking or a code, even if they address you by name.
• To check a gift box or a booking, type the website address yourself rather than clicking a link.
• If you gave gift boxes as presents, warn the people who received them.
• If you receive a suspicious message, the website cybermalveillance.gouv.fr explains the steps to follow.

It remains to be seen how many customers are affected, and in which countries. The answer will come from a future Smartbox communication, or from the follow-up by the Irish authority.