Terravision Data Breach Exposes Over 2 Million Customer Records
What Happened – In February 2023 the European airport‑transfer service Terravision suffered a data breach that exposed 2,075,625 customer records. The leaked data included names, email addresses, phone numbers, dates of birth, country of origin and salted password hashes. Terravision did not respond to multiple attempts by affected individuals to report the incident.
Why It Matters for Trust & Control Assurance
- Continuous third‑party risk monitoring would have flagged gaps in Terravision’s data‑protection controls before the breach occurred.
- Maintaining audit‑ready evidence of vendor security assessments supports defensible compliance with GDPR and other privacy regimes.
- A documented incident‑response process for vendor‑related breaches provides the evidentiary trail required in an audit or regulator inquiry.
Who Is Affected – Transportation & logistics firms that rely on third‑party shuttle services, and the European travelers whose personal data was stored by Terravision.
Recommended Actions
- Review and update your third‑party risk assessment program to include real‑time security monitoring of all service providers handling personal data.
- Verify that any stored passwords use industry‑standard hashing (e.g., bcrypt, Argon2) with unique salts.
- Ensure your incident‑response playbook includes clear escalation paths and evidence‑collection steps for vendor‑related breaches.
Technical Notes – Exposed data types: names, email addresses, phone numbers, dates of birth, geographic location, and salted password hashes. No specific vulnerability (CVE) was disclosed. Source: Have I Been Pwned – Terravision breach