Thermomix Recipe World Forum Breach Exposes 3.1 M User Records
What Happened — In January 2025 the Rezeptwelt forum (rezeptwelt.de) for Thermomix owners suffered a data breach that released the personal details of 3,123,439 registered users. Exposed fields include names, email addresses, phone numbers, physical addresses, dates of birth and user‑provided bios.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate consent and data‑subject‑request processes—exactly the scenario a continuous privacy‑control program is built to prevent and evidence.
- Highlights the need for auditable consent records and a defensible DSAR workflow to satisfy GDPR‑style obligations and to provide regulators with a clear evidence trail.
- Aligns with Verisq’s CookiePLUS Privacy capability, which helps organizations map, monitor and prove the effectiveness of consent management and data‑subject rights controls.
Who Is Affected – Primarily consumers of the Thermomix appliance (retail/e‑commerce) and the forum operator that hosts the user data.
Recommended Actions
- Conduct an immediate inventory of all personal data collected through the forum and verify the lawful basis for each data element.
- Review and tighten consent capture mechanisms; ensure consent is granular, time‑stamped and easily revocable.
- Deploy a DSAR readiness process: automate request intake, track fulfillment timelines, and retain evidentiary logs.
- Map the privacy controls to your framework of record (e.g., GDPR, ISO 27001) and capture continuous evidence for audit readiness.
- Monitor for credential reuse or phishing attempts targeting exposed users.
Technical Notes – The breach source has not been publicly disclosed; no specific vulnerability or CVE was identified. The exposed data types are typical of user‑profile fields collected by community forums. Source: Have I Been Pwned – Thermomix breach