Attackers accessed the system managing app members between October 2 and 7, taking names, birth dates, gender, emails, phone numbers and order history for 11.18 million users; the data later leaked online. No card numbers were stored. The company confirmed the intrusion October 13 and disclosed it October 15.
What to do: Access blocked; regulator notified; phishing warning issued.
· 21 days ago · 11.18 million records · BleepingComputer
Why this score
Over 11 million people (impact 3), completed theft and leak (exploitability 2), retail sector (criticality 0).