ZAP-Hosting Breach Exposes 746,682 Customer Records
What Happened – In November 2021 the web‑hosting provider ZAP‑Hosting suffered a data breach that released more than 60 GB of information. The leak included 746,682 unique email addresses together with browser user‑agent strings, support‑chat logs, IP addresses, names, phone numbers, physical addresses and purchase histories.
Why It Matters for Trust & Control Assurance
- The incident illustrates the exact scenario a continuous privacy‑control program is built to prevent: unauthorized exposure of personally identifiable information (PII).
- Demonstrating robust consent management, data‑subject‑request readiness, and auditable privacy controls is essential to meet regulatory expectations and to provide defensible evidence during audits.
- Verisq’s CookiePLUS capability enables organizations to capture consent provenance, automate DSAR workflows, and generate the evidence needed for GDPR‑style privacy programs.
Who Is Affected – Web‑hosting services, SaaS platforms that store customer PII, and any downstream businesses that rely on ZAP‑Hosting for their infrastructure.
Recommended Actions
- Map the exposed data elements to your privacy control objectives (e.g., consent, data minimisation, DSAR handling).
- Validate that consent records are captured and retained in a tamper‑evident store.
- Update incident‑response playbooks to include forensic evidence collection for privacy‑related breaches.
- Conduct a privacy‑impact assessment and remediate any gaps in data‑handling processes.
Source: Have I Been Pwned – ZAP‑Hosting breach
Technical Notes – The breach involved a large‑scale exfiltration of user‑generated data; the exact attack vector was not disclosed. Exfiltrated data types span identifiers, contact information, device fingerprints, and transaction records.