Aditya Birla Fashion & Retail Breach Exposes 5.47 M Customer Records
What Happened – In December 2021 the e‑commerce platform of Indian retailer Aditya Birla Fashion and Retail Ltd was compromised. Attackers exfiltrated and later dumped more than 5.4 million records, including email addresses, phone numbers, physical addresses, dates of birth, order histories and passwords stored as unsalted MD5 hashes. Employee data such as salary grades, marital status and religion were also released.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential storage and inadequate access controls – a core scenario that continuous control‑assurance programs are built to detect, remediate, and evidence.
- Highlights the need for auditable evidence of data‑protection policies (e.g., strong hashing, encryption, MFA) to satisfy multiple frameworks (NIST CSF 2.0, ISO 27001, GDPR).
- Shows how a documented incident‑response and breach‑notification process provides defensible audit trails and supports regulatory readiness.
Who Is Affected – Retail and e‑commerce organizations handling large volumes of consumer personal data; any vendor storing customer credentials.
Recommended Actions
- Replace MD5 password hashes with salted, adaptive algorithms (bcrypt, Argon2) and enforce MFA for all privileged accounts.
- Conduct a full access‑control review, ensuring least‑privilege principles and regular privileged‑access audits.
- Update incident‑response playbooks, perform a privacy impact assessment, and document evidence for audit readiness.
Source: [Have I Been Pwned – ABFRL breach details]
Technical Notes
- Attack vector: Likely credential‑theft via compromised admin credentials; exact TTPs not publicly disclosed.
- Exfiltrated data types: Email, name, phone, address, DOB, purchase history, passwords (MD5), employee salary grades, marital status, religion.
Source: [HIBP breach API]