TheSqua.re Breach Exposes 107,041 Customer Records Including Emails, Names, and Phone Numbers
What Happened — In June 2025, threat actors posted a dump of 107,041 unique customer records from TheSqua.re to a public hacking forum. The exposed data set contains email addresses, full names, phone numbers, and city‑level geographic locations. The company has not publicly acknowledged the incident despite repeated outreach.
Why It Matters for Trust & Control Assurance
- This breach illustrates the risk of inadequate data‑protection controls (encryption, strict access limits, and monitoring) that a continuous control‑assurance program is designed to detect and evidence.
- Demonstrable privacy‑control maturity (e.g., consent management, DSAR readiness) provides defensible audit evidence and can reduce regulatory exposure after a breach.
- Mapping the incident to a privacy‑focused capability helps organizations prove they have the necessary controls to satisfy multiple frameworks simultaneously.
Who Is Affected – Hospitality‑tech platforms, online travel marketplaces, and any SaaS provider handling personal contact information for consumers.
Recommended Actions
- Initiate a formal incident‑response process and document all evidence of the breach timeline.
- Verify and remediate data‑access controls: enforce least‑privilege, encrypt stored PII, and enable detailed audit logging.
- Review consent records and update privacy notices; prepare for potential DSAR requests.
- Conduct a privacy‑impact assessment and map findings to your audit‑readiness framework.
Technical Notes – Attack vector not disclosed; data appears to have been exfiltrated and posted publicly. Exposed data types: email addresses, full names, phone numbers, city‑level locations. Source: Have I Been Pwned – TheSqua.re breach