Chowbus Data Breach Exposes 444,224 Customer Records
What Happened – In October 2020 the Asian food‑delivery app Chowbus inadvertently emailed a CSV file containing personal data—email addresses, full names, phone numbers and physical addresses—for 444,224 unique accounts.
Why It Matters for Trust & Control Assurance
- The incident is a textbook example of a privacy‑control gap that a continuous assurance program is built to detect and document.
- Demonstrates the need for auditable data‑handling policies, strict access restrictions and evidence of encryption or masking.
- Highlights why organizations must maintain a defensible audit trail to satisfy regulators (e.g., GDPR) and downstream partners.
Who Is Affected – Consumer‑facing e‑commerce and food‑delivery platforms that process personal contact information.
Recommended Actions
- Map the breach to your privacy‑control framework (e.g., GDPR) and identify any missing data‑classification or encryption controls.
- Collect and retain evidence of data‑access logs, encryption status and incident‑response steps for audit readiness.
- Update your incident‑response playbook to include mandatory breach‑notification timelines and customer‑communication templates.
Source: Have I Been Pwned – Chowbus breach
Technical Notes – The breach was disclosed via a public HIBP entry; the exact attack vector was not disclosed, but the exposure resulted from an internal mishandling of a CSV export. The data types exposed were email, name, phone, and address. Source: same as above