Money Bookers E‑wallet Service Breach Exposes 4.48 M Customer Records
What Happened — In 2009 the Money Bookers (now Skrill) e‑wallet platform suffered a data breach that went undetected until October 2015. The incident exposed personal data for 4,483,605 accounts, including names, dates of birth, email addresses, phone numbers, physical addresses, and IP addresses.
Why It Matters for Trust & Control Assurance
- The breach illustrates the risk of insufficient continuous monitoring and delayed incident detection—core elements of a control‑assurance program.
- Demonstrates the need for auditable evidence that data‑handling controls are operating as intended, enabling a defensible response to regulators and auditors.
- Highlights why mapping your controls to a unified framework (VCF) and maintaining real‑time evidence is essential for rapid breach containment.
Who Is Affected – Primarily the financial‑services sector (e‑wallets, digital payments) and any downstream merchants that relied on Money Bookers for payment processing.
Recommended Actions
- Conduct a gap analysis against the VCF control objective for “Incident detection, response, and logging.”
- Deploy continuous monitoring tools that capture authentication, data‑access, and exfiltration events.
- Update your incident‑response playbook to include evidence‑preservation steps for audit readiness.
- Verify that personal‑data handling complies with applicable privacy regulations (e.g., GDPR, CCPA).
Source: Have I Been Pwned – Money Bookers breach
Technical Notes
- Attack vector remains unknown; the breach was discovered six years after the initial compromise.
- Exposed data types: dates of birth, email addresses, IP addresses, full names, phone numbers, physical addresses.
Source: HIBP breach details