Mastercard Priceless Specials – 89,388 Accounts Breached (German Bonus Program)
What Happened — In August 2019 the German Mastercard “Priceless Specials” loyalty program suffered a data breach that exposed the personal information of 89,388 members. The leaked data set included names, email addresses, IP addresses, phone numbers, salutations and partial credit‑card details. The breach was publicly disclosed via Have I Been Pwned and the program was subsequently suspended.
Why It Matters for Trust & Control Assurance
- The incident illustrates a failure to enforce robust privacy‑control monitoring and evidence‑collection practices that a continuous control‑assurance program would require.
- Demonstrable audit evidence of consent management, data‑handling procedures, and breach‑notification readiness is essential for meeting GDPR‑style privacy obligations.
- Leveraging an automated consent‑and‑DSAR solution provides a defensible trail that can be presented to regulators and auditors alike.
Who Is Affected — Financial‑services organizations that run loyalty or payment‑card programs, and the German consumer base whose personal data was compromised.
Recommended Actions
- Conduct a privacy impact assessment (PIA) of the program and map findings to the VCF privacy control objective.
- Review and tighten consent‑capture mechanisms; ensure explicit, revocable consent for all data‑processing activities.
- Implement a DSAR‑ready workflow and retain evidence of request handling for audit purposes.
- Follow GDPR breach‑notification requirements and notify affected individuals promptly.
Technical Notes — The breach details were released by Have I Been Pwned; no specific attack vector (phishing, exploit, insider) has been publicly identified. Exposed data types: email, IP, name, phone, salutations, and partial credit‑card numbers (e.g., last 4 digits). Source: [Have I Been Pwned – Mastercard Priceless Specials breach]