1.5M Customer Accounts Breached at Brazilian Delivery Service James, Exposing Emails, Locations, and Password Hashes
What Happened — In March 2020 the Brazilian delivery platform jamesdelivery.com.br suffered a data breach that exposed 1,541,284 unique email addresses, geographic latitude/longitude pairs, and password hashes (bcrypt). The compromised dataset surfaced in June 2020 via a public breach feed (HIBP) supplied by dehashed.com.
Why It Matters for Trust & Control Assurance
- This breach illustrates the exact scenario a continuous control‑assurance program aims to prevent: weak credential protection and insufficient monitoring of credential‑related assets.
- Demonstrable evidence of strong password‑storage policies, multi‑factor authentication, and regular credential‑access reviews is essential to maintain a defensible audit trail.
Who Is Affected – Logistics & delivery firms, e‑commerce platforms handling consumer accounts, and any organization storing password hashes alongside personally identifiable location data.
Recommended Actions –
- Verify that password storage uses industry‑recommended hashing (e.g., bcrypt with appropriate cost) and enforce MFA for all user accounts.
- Implement continuous monitoring of credential‑access logs and conduct a gap analysis against the “protect credentials” control objective.
- Document remediation steps and retain evidence for audit readiness. Source: https://haveibeenpwned.com/api/v3/breach/James
Technical Notes – The breach source has not been publicly disclosed; no specific vulnerability (CVE) was identified. Exposed data includes email addresses, latitude/longitude coordinates, and bcrypt password hashes. Source: https://haveibeenpwned.com/api/v3/breach/James