Critical Data Breach Exposes 94,584 T2 Tea Store Customer Records
What Happened
In April 2024, approximately 95 k customer records from the T2 tea retailer were posted to a public hacking forum. The disclosed data set contains email addresses, physical addresses, full names, phone numbers, dates of birth, purchase histories, and passwords stored as scrypt hashes.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the risk of insufficient vendor‑side data‑handling controls; a continuous control‑assurance program would have documented encryption, hashing standards, and monitoring of credential stores.
- Highlights the need for auditable evidence that password storage meets industry‑accepted hardening (e.g., scrypt with appropriate work factor) and that any breach is detected and escalated per NIST 800‑61.
- Reinforces the importance of maintaining up‑to‑date third‑party risk registers and evidence of periodic security assessments for SaaS or e‑commerce platforms.
Who Is Affected
- Retail and e‑commerce businesses that collect personally identifiable information (PII) and payment‑related data.
- Food‑and‑beverage brands operating online storefronts.
- Any organization that stores passwords using cryptographic hashes without additional protective controls (e.g., multi‑factor authentication, credential‑rotation policies).
Recommended Actions
- Review all contracts and data‑processing agreements with T2 or similar vendors for breach‑notification clauses and security‑by‑design commitments.
- Validate that password storage employs strong, salted hashing (scrypt) with current work‑factor recommendations; consider adding adaptive MFA.
- Verify that continuous monitoring alerts are configured for anomalous data exfiltration patterns and that incident‑response playbooks are exercised.
- Request a formal incident‑response disclosure from T2, including root‑cause analysis, remediation steps, and evidence of corrective actions.
Technical Notes
- Attack vector: Data exfiltration from T2’s customer database; the precise intrusion method has not been disclosed.
- CVEs: None reported in the public disclosure.
- Data types exposed: Email addresses, physical addresses, full names, phone numbers, dates of birth, purchase histories, and scrypt‑hashed passwords.
Source: https://haveibeenpwned.com/api/v3/breach/T2