Locally Online‑to‑Offline Shopping Platform Breaches 362,619 Customer Records
What Happened
In October 2022 the Locally e‑commerce platform suffered a data breach that exposed 362,619 user accounts. The compromised data set includes email addresses, phone numbers, physical addresses, purchase history, credit‑card type with last‑four digits, and bcrypt password hashes. Locally confirmed the breach privately, but public notification to affected customers has not been verified.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous control‑assurance over credential storage (e.g., salted hashing, rotation, and monitoring of password‑hash leakage).
- Highlights gaps in data‑classification and encryption controls for personally identifiable information (PII) and payment‑card data, a core audit focus under PCI‑DSS and GDPR.
- Serves as a real‑world scenario where a robust incident‑response playbook and evidence‑preservation process are essential for regulator‑ready reporting.
Who Is Affected
- Retail & e‑commerce businesses using Locally’s online‑to‑offline shopping solution.
- Third‑party payment processors that may have handled the exposed partial card data.
- Consumers whose personal and purchase information was stored on the platform.
Recommended Actions
- Review all integrations with Locally to assess exposure of shared customer data.
- Validate that password‑hash storage follows industry‑best practices (e.g., unique salts, adaptive work factor).
- Verify encryption of PII at rest and in transit; remediate any gaps.
- Request a detailed incident‑response disclosure from Locally, including timeline, root cause, and remediation steps.
- Update breach‑notification procedures to ensure timely communication with affected individuals.
Technical Notes
- Attack vector: Not publicly disclosed; breach likely stemmed from compromised credentials or insufficient protection of stored password hashes.
- CVEs: None reported in the public disclosure.
- Data types exposed: Email addresses, phone numbers, physical addresses, purchase history, credit‑card type + last 4 digits, bcrypt password hashes.
Source: https://haveibeenpwned.com/api/v3/breach/Locally