Some Scrooge tried to pick the locks on the Toys “R” Us toy chest.
The toy store chain sent out an email last week to rewards program customers alerting them it was resetting everyone’s passwords in response to an attempted hacking that occurred during the busy holiday season.
“This appears to be related to earlier online breaches of websites not associated with Toys “R” Us, Rewards “R” Us or our vendor,” Toys “R” Us public relations manager Nicole Hayes told NBC News.
“Online user names and passwords stolen during those breaches were then used to attempt to access other online accounts, including Rewards “R” Us account information in an attempt to defraud customers of their rewards coupons,” said Hayes.
Names and addresses may have been compromised in the attack but no credit card details, banking or payment information was in the database.
In an email to customers, the company said the thieves may have been trying to exploit how users have identical passwords for multiple accounts.
The company is reinstating any decrease in points during the attack, which occurred from November 11, 2016 to January 17, 2017. Customers should receive any lost points within a week.
“We are also working with our vendor to ensure they implement additional security protocols to prevent future threats,” said Hayes.
Related: Follow These Tips for Password Safety
Toys “R” Us recommends all its customers change their rewards account password and make sure they don’t reuse passwords between different websites.
Here’s how to reset your Toys “R” Us Rewards “R” Us password:
1. Go to the “Forgot Password” section of the Rewards “R” Us website.
2. Enter your membership number and email address and click “submit.” If you misplaced your membership number, click “forgot membership #” or call 1-800-TOYSRUS.
3. Answer the security question. Create a new password, ideally using a mix of letters, numbers and symbols. Don’t reuse an old password.
4. Click through the pop-up window that appears after you successfully change your password.
5. Log in to your account with your new password.
