Vendor Breach Exposes 2.84 M Giant Tiger Customer Records
What Happened — In March 2024 a third‑party vendor that processes data for Canadian discount retailer Giant Tiger was compromised. The breach released 2,842,669 customer records containing email addresses, full names, phone numbers and physical addresses.
Why It Matters for Trust & Control Assurance
- The incident is a textbook example of a supply‑chain control gap that a continuous third‑party risk‑monitoring program is designed to detect and remediate.
- Demonstrable evidence of vendor due‑diligence (security assessments, contractual clauses, ongoing monitoring) provides a defensible audit trail across frameworks such as NIST CSF.
- Mapping this breach to the “vendor oversight” control objective helps organizations prove they are actively managing supplier risk, not just reacting after an incident.
Who Is Affected – Retail (discount stores) and the 2.8 M Canadian consumers whose personal data was exposed.
Recommended Actions
- Conduct an immediate, comprehensive third‑party risk assessment of the involved vendor, including security posture review and contract compliance.
- Deploy continuous monitoring of vendor controls and collect evidence (assessment reports, audit logs) to support audit readiness and ongoing assurance.
Technical Notes – The breach was attributed to a vendor‑managed system; no specific vulnerability or CVE was disclosed. Exfiltrated data comprised PII (email, name, phone, address). Source: [Have I Been Pwned – Giant Tiger breach]