NCIX was a Canadian computer retailer, similar in concept to Fry’s or Micro Center. It went out of business in 2017 and its data was breached in 2018. Here’s what happened to NCIX.
NCIX was founded in 1996 and went out of business in 2017. It has two claims to fame that outlasted its existence as an ongoing business.
The popular YouTube channel Linus Tech Tips and its associated channels have their roots at NCIX. Prior to striking out on their own, Linus Sebastian and Luke Lafreniere created content for a YouTube channel called NCIX Tech Tips. Initially Linus Tech Tips was an offshoot of NCIX Tech Tips with lower production costs, so as to not affect the NCIX brand.
Why Linus Sebastian and Luke Lafreniere left NCIX and when is a common question. They left NCIX sometime in 2013, later citing disagreement with upper management about the overall direction of NCIX as a company.
The 2018 NCIX data breach
The second and more problematic claim to fame for NCIX is a cautionary tale in security circles. NCIX sustained a data breach in 2018, after it went out of business.
What happened that allowed NCIX’s data to be breached after going out of business? NCIX stored its computer equipment in a warehouse in Richmond, Vancouver, Canada. After failing to pay rent, the landlord liquidated the equipment.
The data was not encrypted, and the drives had not been wiped. The breach was discovered when security consultant Travis Doering found a Craigslist ad offering NCIX servers for sale, with data intact. He examined the data under the auspices of wanting to purchase it. He found customer and employee data, including NCIX founder Steve Wu’s own workstation. In talking more with the person who posted the ad, Doering found out the data had been sold at least five other times. Doering disclosed the details of what he found and how he found it in a September 2018 blog post.
So if you are like me and you heard about the NCIX breach in a security class you were taking, and you wondered if it’s the same NCIX where the Linus Tech Tips guys used to work, it’s the same company.
Why NCIX failed
Two things went wrong for NCIX that led to its demise. Like all retailers, they found competing with Amazon increasingly difficult. But being a computer store, they were also vulnerable to a second online competitor, Newegg. As both Amazon and Newegg built up their logistics and were able to offer fast and cheap shipping, or sometimes free shipping, NCIX had a difficult time competing. If you needed something right away and you lived near NCIX, NCIX was more convenient. But if you didn’t want to drive to the store and fight a crowd, and you were able to wait a day or two, buying online and waiting a day or two was very convenient and also save you money.
NCIX did have an online presence and started early, in 1997, but they weren’t big enough to compete with Amazon or Newegg on selection or price online.
Retail expansion
The second problem they had was also a common malady for brick and mortar retail. They tried to expand too quickly. The company started in Vancouver, Canada, then tried to expand east to Ontario, but then also tried to expand to the United States. Ultimately, NCIX was running 10 locations and had three distribution centers at its peak.
There was nothing fundamentally wrong with this ambition. Fry’s was showing signs of decline long before it went out of business, so it would have been logical for NCIX to try to jump into that void. The problem was they opened too many of them too quickly and the stores were too big. The high overhead caused them to raise prices as pricing was getting more competitive. NCIX started closing stores in July 2017, initially saying it would concentrate on online sales. But the last store closed in November, and on December 1, 2017, it filed bankruptcy.
Since NCIX was a private company, it didn’t have public financial disclosure statements, so it’s difficult to see exactly when the company stopped turning a profit. The data was in the breach, of course, but the people who’ve seen that data generally aren’t talking.
The analogue is the US computer store chain Micro Center. Micro Center has been around since the 1980s. The secret to their success has been that they expand, but very slowly and in a sustainable fashion. They don’t necessarily open a new store every year.
David Farquhar is a computer security professional, entrepreneur, and author. He started his career as a part-time computer technician in 1994, worked his way up to system administrator by 1997, and has specialized in vulnerability management since 2013. He invests in real estate on the side and his hobbies include O gauge trains, baseball cards, and retro computers and video games. A University of Missouri graduate, he holds CISSP and Security+ certifications. He lives in St. Louis with his family.