Neteller Data Breach Exposes 3.6 M E‑Wallet Accounts
What Happened – In May 2010 the e‑wallet service Neteller suffered a breach that exposed the personal and financial records of 3,619,948 accounts. The intrusion went undetected until October 2015, leaking names, email addresses, physical addresses, dates of birth, phone numbers, account balances, IP addresses, security‑question answers and website‑activity data.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of insufficient continuous monitoring and delayed breach detection – a core control‑assurance gap that organizations must evidence they have closed.
- Exposure of personally identifiable information (PII) and financial data triggers privacy‑regulation obligations; a robust privacy‑control program provides defensible audit evidence of consent, data‑handling, and DSAR readiness.
- Demonstrating ongoing oversight of third‑party payment platforms aligns with the control objective of “Data protection and privacy” across multiple frameworks.
Who Is Affected – FinTech and payments providers, digital wallets, and any business that stores customer financial or personal data.
Recommended Actions
- Conduct a privacy‑control gap assessment against the “Data protection and privacy” objective (e.g., GDPR‑style consent, data minimization, retention).
- Implement continuous monitoring for anomalous data access and establish a formal breach‑detection timeline.
- Update consent mechanisms and prepare DSAR processes to ensure rapid, documented responses to future disclosures.
Source: Have I Been Pwned – Neteller breach
Technical Notes
- Attack vector not publicly disclosed; breach likely stemmed from compromised credentials or internal system weakness.
- Data types exposed: account balances, DOB, email, gender, IP, name, phone, physical address, security questions/answers, website activity.
Source: Same as above