A Shelburne gift store has been fined $3,000 by the Attorney General’s Office for not informing its customers of a credit card security breach.
The website of the Shelburne Country Store was hacked in late 2013, resulting in the exposure of the credit card information of 721 Internet buyers, according to a news release from the AG’s office.
The company fixed the breach promptly, but failed to notify its customers of the attack, the release said.
Under Vermont’s Security Breach Notice Act, businesses are required to send the Attorney General a confidential notice within 14 business days of discovery of a data breach and are required to notify customers within 45 days.
“At this stage of the game, having seen widely reported data breaches at big retailers like Target and dozens of others, we will not accept the excuse that a business did not know of its obligations to report a breach,” Attorney General Bill Sorrell said in a statement.
Businesses that have questions about the law are urged to check the Attorney General’s website, call the office at 828-5479, or email data.security@state.vt.us.