EatStreet Data Breach Exposes 6.35 M Customer Records, Including Partial Credit‑Card Data
What Happened — In May 2019 the online food‑ordering platform EatStreet disclosed that an unauthorized party accessed its user database, compromising 6,353,564 accounts. The breach exposed names, dates of birth, email addresses, phone numbers, physical addresses, gender, social‑media profile links, partial credit‑card numbers, and passwords stored as bcrypt hashes.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential protection and weak access‑control safeguards – a core control area that continuous‑monitoring programs are built to verify.
- Highlights the need for defensible evidence that password storage follows strong hashing standards and that privileged access is logged and reviewed.
- Provides a real‑world trigger for organizations to validate their data‑handling and encryption controls against a unified control framework.
Who Is Affected – Retail & e‑commerce operators, SaaS platforms handling consumer payments, and any organization that stores personally identifiable information (PII) and payment data.
Recommended Actions
- Review and harden password‑storage policies; ensure use of industry‑recommended hashing (e.g., bcrypt with appropriate cost).
- Implement continuous monitoring of privileged‑access logs and enforce least‑privilege principles.
- Conduct a gap analysis against the “credential protection” control objective and collect evidence for audit readiness.
Technical Notes – The breach vector was not publicly disclosed; however, the exposure of bcrypt‑hashed passwords suggests credential theft possibly via a database compromise. No specific CVE is associated. Source: Have I Been Pwned – EatStreet breach