Blooms Today Breach Exposes Over 3.1 M Customer Records Including Partial Credit Card Data
What Happened — In April 2024, a data set containing 3,184,010 unique records from the online florist Blooms Today was posted for sale on a hacking forum. The exposed data includes email addresses, names, phone numbers, physical addresses, and partial credit‑card details (card type, last 4 digits, expiry). Blooms Today has not commented on the incident.
Why It Matters for Trust & Control Assurance
- This breach illustrates the exact scenario a continuous control‑assurance program aims to prevent: unauthorized access to personally identifiable information (PII) and payment‑related data.
- Demonstrating robust privacy controls—such as consent management, data minimisation, and audit‑ready evidence of protection—helps organisations meet regulatory expectations and provide defensible proof during audits.
Who Is Affected – Retail and e‑commerce businesses that collect customer contact and payment information.
Recommended Actions
- Map the exposed data elements to your privacy control objectives (e.g., consent, data minimisation, encryption) and collect evidence of compliance.
- Verify that logging, monitoring, and incident‑response processes captured the breach timeline; update playbooks and conduct a post‑incident review.
- Deploy a consent‑management solution to ensure ongoing lawful processing of customer data.
Technical Notes – The breach appears to be a data‑exfiltration incident; the exact attack vector was not disclosed. Exposed fields: email, name, phone, address, partial credit‑card (type, last 4 digits, expiry). Source: [Have I Been Pwned – Blooms Today breach]