HomeRefill Data Breach Exposes 187,457 Brazilian Consumer Records
What Happened — In April 2020 the now‑defunct Brazilian e‑commerce site HomeRefill suffered a breach that released 187,457 user records. The disclosed data set includes names, email addresses, phone numbers, dates of birth and salted password hashes.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate data‑retention and disposal practices—controls that continuous assurance programs must monitor and evidence.
- Highlights the need for strong credential storage policies (salting, hashing, and periodic review) to satisfy privacy‑focused audit requirements.
- Provides a concrete example of personal‑data exposure that must be documented in a defensible audit trail for GDPR‑ or CCPA‑aligned compliance.
Who Is Affected – Retail and e‑commerce operators handling consumer personal data, especially those with legacy or decommissioned platforms.
Recommended Actions –
- Conduct a privacy impact assessment of any legacy databases and verify that password storage follows current best‑practice hashing.
- Update data‑retention policies to ensure timely deletion of inactive accounts and maintain evidence of disposal.
- Map the incident to your privacy control framework and collect supporting artifacts for audit readiness.
Technical Notes – The breach source was not publicly disclosed; the exposure appears to stem from inadequate protection of stored credentials and insufficient data‑deletion controls. No specific vulnerability (CVE) was identified. Source: Have I Been Pwned – HomeRefill breach