FreshMenu Data Breach Exposes 110,355 Customer Records Including Personal and Purchase Information
What Happened — In July 2016 the India‑based food‑delivery platform FreshMenu suffered a data breach that exposed the personal details of more than 110 k customers, including names, email addresses, phone numbers, home addresses and order histories. FreshMenu confirmed it was aware of the breach but chose not to notify the affected individuals.
Why It Matters for Trust & Control Assurance
- Highlights the need for a documented incident‑response program that captures evidence of detection, containment and notification.
- Demonstrates why continuous monitoring of data‑handling controls and a defensible audit trail are essential for privacy‑regulation readiness.
- Shows the importance of consent‑management and breach‑reporting capabilities to meet legal obligations and maintain customer trust.
Who Is Affected
- Retail / e‑commerce (food‑delivery) services handling consumer personal data.
Recommended Actions
- Review and formalize your breach‑response and notification procedures; ensure they are exercised and evidence is retained for auditors.
- Implement a consent‑management solution that records user permissions and can generate DSAR‑ready reports.
- Conduct a privacy‑control gap assessment against relevant regulations (e.g., GDPR, CCPA) and map findings to your control‑assurance framework.
Source: Have I Been Pwned – FreshMenu breach
Technical Notes
- Attack vector: not publicly disclosed (likely credential compromise or misconfiguration).
- Exposed data types: device information, email addresses, names, phone numbers, physical addresses, purchase history.