Thermëa spa advises customers of data hack

Hey there, time traveller!
This article was published 05/04/2023 (911 days ago), so information in it may no longer be current.

Manitobans who’ve recently bought gift cards for Nordic-style spa Thermëa have been warned their personal information may have been leaked in a data breach.

Groupe Nordik, the parent company of Thermëa, sent an email to affected customers on Tuesday flagging the data breach.

A “non-authorized third party” may have accessed the names and last four digits of credit cards, plus other personal information, of people who bought gift cards through the brand from Nov. 4, 2022 through Feb. 27, 2023, said the mass email from Groupe Nordik.

“We have since conducted a thorough review of security measures in all Groupe Nordik systems,” the email continues.

The company said it became aware of “suspicious activity” on its gift certificate system in late February.

“(We) immediately shut down the system to investigate with a best-in-class third-party cyber security firm,” a company spokesperson wrote in a statement.

Since then, the company has enhanced security measures and will continue working with the cyber security firm to “maximize the protection of our clients’ data,” the statement continued.

Groupe Nordik has been working with law enforcement on the issue, the spokesperson wrote.

The company did not reveal how many Manitobans have been affected.

Richard Ilagan, 20, received the notice Tuesday.

“At first, I thought it was an email saying the gift cards weren’t valid or something,” he said.

Then he read the email further — it wasn’t a validity problem. He bought a Thermëa gift card for a friend early in February. Later in the month, he had to replace his credit card.

The morning of Feb. 16, he received three separate charges of $105.86 from Uber Canada. He didn’t make those transactions, he said, so he cancelled his card.

“Once I heard that Nordik Spa had their data breach, I was like, ‘Oh, that’s probably what it was,’” Ilagan said.

He hasn’t confirmed the data breach was the reason for his account being hacked.

“It is what it is,” Ilagan said of the breach. “I’m not super angry, but I wouldn’t be angry at some sort of compensation.”

He’d buy another gift card for Thermëa, though he’d rather go to the spa and “skip the whole gift certificate process,” he said.

In its email, Groupe Nordik asked customers to report suspicious activity, including emails and text messages, to local police.

Unused gift certificates are still valid, the email continued.

“Our customers’ data privacy and security is of the utmost importance,” a Groupe Nordik spokesperson wrote in a statement. “It is unfortunate that data breaches are so commonplace today.”

Groupe Nordik opened Thermëa in Winnipeg, on the Crescent Drive Golf Course, in 2015. It has locations in Whitby, Ont. and Chelsea, Que.

gabriellle.piche@winnipegfreepress.com