Cyber Incident Victim: Brabantia B.V.
Date:
Jun 2015
Location:
Netherlands
Summary
A Dutch manufacturer experienced unauthorized database access compromising customer names, email addresses, and product order details, though financial data was not stored. The company invalidated all account passwords as a precaution, prompting users to reset credentials, while internal checks found no indications of plaintext password storage. The breach was identified through routine monitoring, with response handled externally as no board members were immediately available for comment.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 3 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On June 5, 2015, Dutch household goods manufacturer Brabantia disclosed a cybersecurity breach affecting customer accounts. The company detected unauthorized access to its database accounts within the previous 24 hours through routine monitoring systems. Brabantia notified customers via email that personal information may have been compromised, though the full extent of data exposure remained unclear. The potentially affected information included customer names, email addresses, and records of products ordered. The company explicitly stated it did not store credit card or debit card details, limiting the scope of financial risk. As an immediate containment measure, Brabantia invalidated all customer account passwords and required users to reset credentials through their existing usernames.
The breach response raised questions about password storage practices, though external analysis by The Register found no overt indicators of plaintext password storage in Brabantia's systems. Account registration processes displayed masked passwords as asterisks without character limitations during creation. Brabantia published a formal statement on its corporate website alongside individual customer notifications. Press inquiries were redirected to Eric van der Palen, an online marketing representative, who deferred substantive comment to unreachable board members. The incident occurred against a backdrop of increasing retail sector breaches, though financial services remained more frequent targets according to contemporaneous regulatory data. Customer account functionality was restored through mandatory password resets without reported service interruptions.