Preen.Me Data Breach Exposes 236,105 User Records After Ransom Attack
What Happened — In May 2020 the social‑media marketing platform Preen.Me was hit by a ransomware operation. The attackers published a data set containing 236,105 unique email addresses, names, usernames and links to social‑media profiles.
Why It Matters for Trust & Control Assurance
- This incident illustrates the exact scenario a continuous third‑party risk‑management program is built to detect, monitor, and evidence.
- Demonstrable vendor‑oversight controls (contractual security clauses, periodic assessments, and real‑time monitoring) provide the defensible audit trail regulators and partners expect after a breach.
Who Is Affected – Marketing SaaS providers, their client brands, and any downstream services that rely on the exposed user data.
Recommended Actions –
- Map the breach to your vendor‑oversight control objective and verify that you have up‑to‑date security attestations for all marketing‑service providers.
- Collect evidence of continuous monitoring (e.g., security‑posture dashboards, breach‑notification logs) to demonstrate due‑diligence in audit reviews.
Technical Notes – The attack vector was ransomware malware that exfiltrated user records. Exposed data included email addresses, full names, usernames and public social‑media profile URLs.