Costco says card skimmers were found at Chicago-area warehouses, less than 500 people affected

Costco has confirmed a card skimming attack that forced them to send out notification letters to victims last week. 

In a statement to ZDNet, the global retail giant said that in August, they discovered five card skimmers on payment card devices in four of their Chicago-area warehouses. 

“We promptly removed the skimmers, notified law enforcement, and engaged a forensics firm to analyze the devices,” a Costco spokesperson said. 

“It appears that these skimmers had the ability to capture information on the magnetic stripe of a payment card, including name, card number, expiration date, and CVV. We identified the members who conducted swipe payment card transactions on the affected devices during the relevant time period and notified them individually. We also offered them complimentary credit monitoring and identity theft-related services,” the company added.  

The spokesperson said less than 500 customers were affected by the situation and that all of the customers were notified by letter on November 5.

The company believes the attack took place in August but did not answer questions about how long they believe the card skimmers were active. 

Costco inspectors did not find similar card skimmers at any other locations, according to their spokesperson. Costco is the fifth largest retailer in the world and fourth largest in the US, with 810 stores worldwide.

Multiple people from across the globe took to social media over the past few weeks to complain about fraudulent charges tied to their Costco credit cards or accounts. Others said they began to see the charges after using their cards at Costco locations, particularly Costco gas stations. 

“Noticed a fraudulent charge on my credit card, so I called to get it handled. The guy on the phone asked if I pay at the pump usually for gas, and I said yes. Apparently, skimmers for information are common on pay at pump systems and car washes,” one Reddit user wrote. “That was the only place he saw in my history that was likely to have stolen my information. He recommended paying inside, but Costco doesn’t even have that option. Just a reminder to always check your credit card statements and watch for fraudulent charges!”

The letter Costco sent to the hundreds of victims they believe were affected by the card skimming attack advises the victims to call their bank to “discuss possible options for avoiding potential problems in case” their card was inappropriately used. 

Costco is offering victims IDX identity theft protection services which include 12 months of credit monitoring, a $1 million insurance reimbursement policy, and ID theft recovery services.