Home Chef Data Breach Exposes 8.8 M Customer Records Including Partial Credit‑Card Data
What Happened — In early 2020 the food‑delivery platform Home Chef suffered a breach that was later sold on underground forums. The leak contained email addresses, names, IP addresses, post codes, phone numbers, the last 4 digits of credit‑card numbers and passwords stored as bcrypt hashes.
Why It Matters for Trust & Control Assurance
- The incident illustrates the exact scenario a continuous control‑assurance program aims to prevent: uncontrolled access to credential stores and insufficient protection of payment‑related data.
- Demonstrable evidence of strong identity‑access policies, MFA enforcement, and secure password‑handling can provide a defensible audit trail and reduce exposure in future investigations.
Who Is Affected — Consumers of Home Chef’s online ordering service (retail/e‑commerce), payment processors linked to the platform, and any downstream partners that rely on the same credential store.
Recommended Actions
- Verify that password hashing algorithms are up‑to‑date and that salts are unique per user.
- Enforce multi‑factor authentication for all privileged and customer‑facing accounts.
- Conduct a control‑mapping exercise against the “Identity & Access Management” objective in your assurance framework and collect evidence of policy enforcement.
- Monitor for credential reuse or credential‑theft alerts in real time and update incident‑response playbooks accordingly.
Technical Notes — The breach exposed ~8.8 M records; passwords were stored as bcrypt hashes, and only the last 4 digits of credit‑card numbers were visible. Source data were supplied to HaveIBeenPwned by dehashed.com. Source: https://haveibeenpwned.com/api/v3/breach/HomeChef