ENKR

E-Store ShopServe online-shop platform breach

Add to my breach check

Made public · about 23.36 million people

What leaked10

Replaceable

  • Password
  • Card expiry date

Hard to replace

  • Mobile number
  • Home or delivery address
  • Partial card number
  • Email address
  • Employer
  • Other profile data
  • Username

Permanent

  • Full name
  • Passwordmember passwords, encrypted · E-Store judges they are unlikely to be worked out; also ShopServe admin passwords of shops and passwords of affiliate-programme members, storage not stated
  • Card expiry datesame about 2,096,900 people
  • Mobile numberphone number (type not stated) and fax number
  • Home or delivery addressbuyer and delivery addresses
  • Partial card numberfirst 6 and last 4 digits and cardholder name, about 2,096,900 people; full card numbers and security codes were not held
  • Employerworkplace
  • Full namebuyers and delivery recipients
  • Other profile dataanything else the customer entered freely; for shops, the sales manager's name and the shop's name, address and phone and fax numbers printed on convenience-store payment slips
  • Usernamemember IDs · including newsletter members; ShopServe admin login IDs of shops

To-dos6 · about 1 h 30 min in all

  1. Change the leaked password everywhere you reused itabout 30 minfreeStops: account takeover
  2. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  3. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls
  4. Turn on two-step sign-in for email and bankingabout 15 minfreeLimits harm from: account takeover
  5. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: account takeover
  6. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next13 events

  1. Undetected 2 events72 days · Back to latest
  2. Response 11 eventsNotice in 76 days · show events
  3. RemedyNone on record
  4. PenaltyNone on record
  5. DisputesNone on record

Undetected: 2 events

Back to latest
  1. Became aware of the unauthorised access and cut off traffic from the attacker the same day
  2. Intrusion began
Company
E-Store
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
about 23.36 million people: buyers and members of 7,858 current and former ShopServe shops, plus shop operators and affiliates, de-duplicated as far as possible; about 2,096,900 of them with partial card data · final report

How the facts developed

  1. Final report: about 23,356,000 people, about 2,096,900 of them with partial card data, at 7,858 shops; shop mail and FTP logins and the shops' payout bank accounts were removed from the leaked items
  2. Second report: the access began on 21 May; partial card numbers (first 6 and last 4 digits), cardholder names and expiry dates, member IDs and passwords, and shop data, including shops' payout bank accounts, were added
  3. First report: buyer data was sent out from a ShopServe server on 1 August, up to 8,853,839 records with duplicates possible; whether card data was included was still under investigation

Sources