Bangladeshi IT Services Provider Tappware Exposes 94,734 Personal Records
What Happened
In April 2024, threat actors accessed the Tappware customer database and published approximately 95 k unique records on a public hacking forum. The dump contains email addresses, full names, physical addresses, dates of birth, gender, job titles, phone numbers, religion, and scanned images of government‑issued national ID cards.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the risk of insufficient data‑at‑rest encryption and lack of tokenization for personally identifiable information (PII).
- Highlights the need for continuous control‑assurance processes that verify vendor‑side data‑handling policies and evidence of regular security assessments.
- Serves as a real‑world example of why organizations must maintain defensible audit trails for data‑access logs and breach‑response documentation.
Who Is Affected
- IT services and outsourcing firms operating in Bangladesh or serving Bangladeshi clients.
- Employers and HR departments that supplied employee data to Tappware.
- Individual citizens whose personal and government‑issued identification data were disclosed.
Recommended Actions
- Conduct a rapid vendor‑risk review of Tappware contracts and data‑processing agreements.
- Verify that encryption, tokenization, and least‑privilege access controls are enforced for all stored PII.
- Activate incident‑response playbooks, request a detailed forensic report from Tappware, and notify affected individuals per local data‑protection regulations.
Technical Notes
- Attack vector: Likely unauthorized database access via compromised credentials or insufficiently segmented network zones.
- CVEs: None publicly disclosed in the breach report.
- Data types exposed: Dates of birth, email addresses, gender, government‑issued IDs (scans), job titles, names, phone numbers, physical addresses, religion.
Source: https://haveibeenpwned.com/api/v3/breach/Tappware