Amart Furniture Warranty Claims Database Breach Exposes 108,940 Customer Records
What Happened – In May 2022 Amart Furniture disclosed that a cyber‑attack compromised its warranty‑claims database hosted on Amazon Web Services. The attacker accessed and published 108,940 records containing email addresses, full names, phone numbers, physical addresses, and passwords stored as bcrypt hashes.
Why It Matters for Trust & Control Assurance
- The incident illustrates a failure to maintain continuous oversight of a critical third‑party cloud provider, a core control‑objective for vendor risk management.
- Without defensible evidence that cloud‑hosted services meet security expectations, organizations cannot reliably demonstrate audit readiness across frameworks that map to this objective.
- Continuous monitoring and documented due‑diligence provide the audit trail needed to prove that third‑party risks are being managed in real time.
Who Is Affected – Retail and e‑commerce firms that store customer data in cloud‑hosted applications, especially those using SaaS or IaaS platforms for warranty, CRM, or similar functions.
Recommended Actions
- Review cloud‑provider contracts for explicit security and breach‑notification clauses.
- Deploy continuous third‑party risk monitoring to collect evidence of AWS security controls (e.g., configuration, access logging).
- Validate that credential storage follows best‑practice hashing and that encryption is applied to PII at rest and in transit.
Source: Have I Been Pwned – Amart Furniture breach
Technical Notes
- Attack vector not publicly disclosed; breach appears to be a targeted compromise of the AWS‑hosted database.
- Exposed data includes bcrypt‑hashed passwords, which mitigates plain‑text exposure but still requires credential rotation.
Source: HIBP breach details