Swvl Bus Service Data Breach Exposes Over 4.2 M User Records
What Happened
In June 2020 the Egyptian transportation platform Swvl suffered a data breach that compromised 4,195,918 user accounts. The exposed dataset included names, email addresses, phone numbers, profile photos, partial credit‑card details (card type and last 4 digits), and passwords stored as bcrypt hashes. The information was later circulated within online hacking communities and reported to Have I Been Pwned.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous control‑assurance around credential protection (strong hashing, MFA, secret‑management) and payment‑card data handling (PCI‑DSS scoped encryption).
- Highlights the importance of data‑classification and retention policies that limit exposure of personally identifiable information (PII) and partial payment data.
- Underlines the requirement for real‑time monitoring and breach‑notification workflows that produce defensible evidence for auditors and regulators.
Who Is Affected
- Transportation & mobility services (ride‑share, bus‑booking platforms)
- Mobile‑app providers handling large volumes of PII and payment information
- Any third‑party vendors that integrate with Swvl’s API or data pipelines
Recommended Actions
- Review Swvl as a third‑party vendor; assess contractual security controls and data‑processing agreements.
- Validate that passwords are stored using industry‑recommended hashing (bcrypt with appropriate cost) and consider adding MFA for user accounts.
- Ensure any stored credit‑card data is encrypted at rest and scoped to PCI‑DSS requirements; purge unnecessary partial card details.
- Deploy continuous monitoring for credential leaks (e.g., dark‑web, HIBP) and document detection/response procedures.
- Request Swvl’s incident‑response report and verify that corrective actions (patches, access‑control reviews) have been completed.
Technical Notes
- Attack vector: Not publicly disclosed; breach likely stemmed from external intrusion or inadequate access controls.
- CVE(s): None reported.
- Data types exposed: Email addresses, full names, phone numbers, profile photos, partial credit‑card data (type, last 4 digits), bcrypt password hashes.
Source: https://haveibeenpwned.com/api/v3/breach/Swvl