2020 ShopBack — 1.5M users, S$74,400 fine
Data compromised
Emails, names, phones, bank accounts, partial card numbers
Technical writeup
Access key leaked by senior engineer. 1.5M emails, 840K names, 447K mobile numbers, 299K bank accounts, 378K credit card instances. Data sold on Raidforums. PDPC fined S$74,400 for inadequate access key management.
Root cause
Leaked access key; inadequate key management