Shitexpress Breach Exposes 23,817 Customer Records Including Emails, Addresses, and Purchase Details
What Happened — In August 2022 the online faeces‑delivery service Shitexpress suffered a data breach that compromised 23,817 user accounts. Exfiltrated data included email addresses, IP addresses, full names, physical mailing addresses, private messages, and purchase information such as invoices and PayPal records.
Why It Matters for Trust & Control Assurance
- The incident illustrates a gap in the organization’s privacy‑control lifecycle – a continuous‑monitoring program should detect and log unauthorized data access in real time.
- Demonstrating defensible evidence of consent management, data‑minimisation, and DSAR readiness is essential for meeting GDPR‑style privacy obligations and for reassuring auditors.
- Leveraging a privacy‑focused control‑assurance capability (CookiePLUS) helps turn raw logs into audit‑ready artifacts that prove you’re meeting the “protect personal data” control objective across multiple frameworks.
Who Is Affected — Retail/e‑commerce providers handling consumer‑level personally identifiable information (PII).
Recommended Actions
- Conduct an immediate privacy‑impact assessment and map the exposed data elements to the “protect personal data” control objective.
- Verify that consent records for marketing communications are current; remediate any gaps in opt‑in/opt‑out handling.
- Update DSAR procedures, ensure they are documented, and run a tabletop exercise to validate response times.
- Deploy continuous logging of data‑access events and integrate them with a privacy‑control dashboard for audit evidence.
Source: Have I Been Pwned – Shitexpress breach
Technical Notes
- Attack vector not disclosed; possibilities include credential compromise or mis‑configured storage.
- Data types exposed: email, IP, name, physical address, private messages, purchase records (invoices, PayPal).