Addi Fintech Breach Exposes 34.5 M Colombian Customer Records
What Happened — In March 2026 Addi detected unauthorized activity on its platform and warned customers that personal information might have been compromised. The “pay‑or‑leak” extortion group ShinyHunters claimed responsibility, publishing a dataset covering 34,532,941 unique accounts that includes IDs, credit scores, income, location and purchase history.
Why It Matters for Trust & Control Assurance
- This incident is a textbook example of why continuous privacy‑control assurance (consent tracking, data‑access monitoring, and audit‑ready evidence) is essential.
- Demonstrable privacy controls provide a defensible trail for regulators and auditors after a large‑scale data exposure.
- Leveraging a consent‑management capability helps organizations quickly verify that data‑handling practices align with legal obligations.
Who Is Affected — Colombian fintech customers; broader financial‑services sector that relies on credit‑scoring data.
Recommended Actions — Review and tighten consent‑management processes, enforce strict data‑access controls, and collect continuous evidence of privacy controls for audit readiness. Source: https://haveibeenpwned.com/api/v3/breach/ADDI
Technical Notes — Exposed data includes email addresses, government‑issued IDs, credit scores, income levels, IP addresses, geolocation, and purchase history. The breach was publicized by ShinyHunters; no specific vulnerability (CVE) was disclosed. Source: https://haveibeenpwned.com/api/v3/breach/ADDI