Shopper+ Data Breach Exposes 878,290 Customer Records
What Happened — In March 2023, Canadian e‑commerce site Shopper+ announced that a breach first seen on a public hacking forum dated back to September 2020. The incident exposed 878,290 customer records containing names, email addresses, phone numbers, physical addresses, dates of birth, genders and spoken languages.
Why It Matters for Trust & Control Assurance
- The breach illustrates a gap in identity‑and‑access management that continuous‑control monitoring programs are designed to detect and remediate.
- Defensible audit evidence (access logs, privileged‑account reviews) would have helped demonstrate due‑diligence to regulators and partners.
- Ongoing verification of access‑control policies is a core control objective that satisfies multiple frameworks (e.g., NIST CSF, ISO 27001).
Who Is Affected — Retail and e‑commerce organizations that store personal consumer data, especially those operating in Canada or handling similar PII.
Recommended Actions
- Perform an immediate privileged‑access review of all accounts that can view or modify customer data.
- Deploy continuous monitoring and logging of access to personal information, and retain logs for audit purposes.
- Update incident‑response playbooks to include data‑exposure scenarios and evidence‑collection procedures.
Source: Have I Been Pwned – Shopper+ breach
Technical Notes
- Attack vector not disclosed; breach surfaced on a public hacking forum.
- Exposed data types: names, email addresses, phone numbers, physical addresses, dates of birth, genders, spoken languages.