Promofarma Online Pharmacy Breach Exposes 1.27M Customer Emails and Names
What Happened — In August 2019 a data set from the Spanish online pharmacy Promofarma appeared for sale on a dark‑web marketplace. The leak contained 1,277,761 unique email addresses and associated customer names, later added to Have I Been Pwned by dehashed.com.
Why It Matters for Trust & Control Assurance —
- The incident is a textbook example of a data‑protection control gap that a continuous control‑assurance program is designed to detect, document, and remediate.
- Without auditable evidence of encryption, access restrictions, and retention policies, organizations cannot readily demonstrate compliance with privacy regulations such as GDPR.
- Mapping this breach to the single control objective of “protect personal data” yields a defensible audit trail that satisfies many framework requirements simultaneously.
Who Is Affected — Online pharmacies, health‑focused e‑commerce platforms, and any organization that processes EU personal data.
Recommended Actions — Review and map your data‑handling processes to the privacy control objective, collect evidence of encryption and access restrictions, and implement continuous monitoring to surface gaps before they lead to exposure. Source: https://haveibeenpwned.com/api/v3/breach/Promofarma
Technical Notes — The breach was disclosed via a dark‑web marketplace; no specific vulnerability or exploit was identified, suggesting a failure in data‑governance or access‑control practices rather than a technical flaw. Source: https://haveibeenpwned.com/api/v3/breach/Promofarma