Netshoes Breach Exposes ~500K Customer Records (DOB, Email, Names, Purchases)
What Happened — In December 2017 a dataset containing 499,836 Netshoes customer records was posted publicly. The data set includes dates of birth, email addresses, names, and purchase histories. Netshoes later verified that the identifiers in the dump match its own customer base, confirming a high likelihood the data originated from its systems.
Why It Matters for Trust & Control Assurance —
- The incident reflects a lapse in privacy‑control assurance, a core objective for protecting personally identifiable information.
- Continuous monitoring of data‑access privileges and auditable consent records would surface such gaps before they become public.
- Demonstrable, audit‑ready evidence of privacy controls helps satisfy regulator inquiries and preserves customer trust.
Who Is Affected — Retail and e‑commerce businesses that handle personal and purchase data; customers of Netshoes in Brazil.
Recommended Actions —
- Map the breach to your privacy‑control objectives (e.g., consent management, data‑access reviews) and collect evidence of existing controls.
- Conduct a focused privileged‑access audit to ensure only authorized personnel can retrieve PII and remediate any over‑privileged accounts.
- Update consent and DSAR processes to guarantee readiness for regulator or consumer requests. Source: https://haveibeenpwned.com/api/v3/breach/Netshoes
Technical Notes — No specific vulnerability or CVE was disclosed; the exploitation method remains unknown. Exposed data types: dates of birth, email addresses, names, and purchase histories. Source: https://haveibeenpwned.com/api/v3/breach/Netshoes