V‑Tight Gel Breach Exposes Over 2 Million Personal Records
What Happened – In early 2016 a data set containing 2,013,164 records from V‑Tight Gel (a vaginal‑tightening product) was posted publicly. The dump included email addresses, IP addresses, full names, phone numbers and physical addresses. The breach also covered ~50 other wellness‑related domains owned by the same entity, indicating a broader exposure of the organization’s customer database.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate data‑handling policies and the need for continuous evidence that personal data is protected, a core objective of any control‑assurance program.
- Highlights the importance of a privacy‑focused control framework (e.g., consent management, data minimisation, and breach‑response documentation) that can be surfaced instantly in a Trust Center.
- Shows that without demonstrable privacy controls, organizations cannot provide a defensible audit trail to regulators or partners.
Who Is Affected – Consumer‑health and wellness companies that collect personally identifiable information (PII) from customers, as well as the individuals whose data was exposed.
Recommended Actions
- Map the exposure to your privacy‑control objectives (data classification, consent, retention, breach‑notification).
- Collect and preserve evidence of existing privacy controls (policy documents, consent logs, encryption usage).
- Conduct a gap analysis and remediate any missing controls; update your privacy notice and incident‑response playbook.
- Test your breach‑notification process against regulatory timelines.
Technical Notes – The breach source was not publicly disclosed; no specific vulnerability or exploit was identified. The data appears to have been extracted from the vendor’s backend systems and later shared on public breach‑monitoring sites. Source: Have I Been Pwned – V‑Tight Gel breach