Hackers have breached the accounts of about 6,450 Gen Digital Inc. customers, TechCrunch reported on Sunday.

Gen Digital Inc. is a publicly traded maker of antivirus software for consumers. The company was formed last September through the merger of cybersecurity providers Norton LifeLock Inc. and Avast plc. Besides antivirus software, Gen Digital also sells other cybersecurity products including a password manager and a virtual private network tool. 

Reports that some Gen Digital customer accounts had been breached first emerged on Friday. The next day, the company told Bleeping Computer in a statement that it has “secured 925,000 inactive and active accounts that may have been targeted” by hackers. On late Sunday, TechCrunch reported that 6,450 customers’ accounts were breached.

Gen Digital believes that the hackers may have accessed the names, phone numbers and mailing addresses of affected customers. The company also determined that the breach may have compromised some user data stored in its Norton Password Manager tool. According to Gen Digital, it’s possible the hackers accessed the login credentials that affected customers kept in Norton Password Manager.

Gen Digital said in a statement that its systems were not compromised in the breach. According to the antivirus maker, the hackers gained access to customer accounts through a credential-stuffing attack. That’s a type of cyberattack in which hackers use login credentials stolen from one company to compromise the customers of another.

“Systems have not been compromised, and they are safe and operational, but as is all too commonplace in today’s world for bad actors to take credentials found elsewhere, like the dark web, and create automated attacks to gain access to other unrelated accounts,” a company spokesperson told Bleeping Computer. 

Gen Digital first identified the breach on Dec. 12 after detecting a large number of failed login attempts that targeted its customers’ accounts. The company has determined that the hackers began accessing customer accounts as early as Dec. 1.

After detecting the breach, Gen Digital notified affected customers and reset their passwords. The company says that it has also taken “additional security measures” to protect customers.

The incident comes a few weeks after LastPass US LLP, one of Gen Digital’s major competitors in the password manager market, experienced a breach. The breach was preceded by another cyberattack against the company last August. According to LastPass, hackers used technical information stolen in the August cyberattack to access its cloud storage environment.

The breach saw the hackers steal customer information such as usernames and billing addresses. They also obtained an encrypted backup copy of the login credentials that users kept in LastPass’ password manager. According to the company, the encrypted copy can’t be decrypted without users’ account passwords, which weren’t affected by the breach. 

Image: Gen Digital