Shoe Zone Breach Exposes 46,140 Customer Records Including Partial Credit Card Details
What Happened – In June 2024 the UK footwear retailer Shoe Zone disclosed that a data set covering over 100 k orders was posted for sale on a hacking forum. The dump contained names, physical addresses, email addresses and the last four digits of credit‑card numbers for 46 140 unique customers.
Why It Matters for Trust & Control Assurance
- Continuous privacy‑control monitoring would have flagged anomalous data extraction and provided a defensible audit trail.
- Evidence of robust data‑classification, encryption and access‑review processes is essential to demonstrate compliance with privacy regulations.
- A documented privacy‑impact assessment and ready‑to‑show controls reduce remediation time and regulator scrutiny.
Who Is Affected – Retail and e‑commerce organisations handling UK consumer data, especially those that store payment‑card information.
Recommended Actions
- Perform an immediate gap analysis against GDPR‑style data‑protection requirements.
- Verify that card‑holder data is encrypted at rest and that access logs are collected and reviewed continuously.
- Document the incident response steps taken and retain evidence for audit readiness.
Source: Have I Been Pwned – Shoe Zone breach
Technical Notes – The breach was posted on a public hacking forum; the exact attack vector (phishing, credential theft, etc.) was not disclosed. Exposed data types: email addresses, names, physical addresses, partial credit‑card numbers (card type and last 4 digits), and purchase details. Source: same as above