Piotr i Paweł

Summary

Spar experienced a hacking incident that resulted in unauthorized access to its systems and the exposure of customer personal data. The compromised data included names, surnames, phone numbers, email addresses, and delivery addresses, which could lead to unwanted contact and potential fraud attempts. The company responded by securing its systems, identifying and blocking the source of the breach, and notifying the relevant data protection authority.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On 21 May 2025, unauthorized access to the IT systems of WSS Detal Sp. z o.o., operator of the Spar online store, resulted in a leak of personal data. The compromised data included customers' first and last names, telephone numbers, email addresses, and delivery addresses. The company noted that the delivery addresses compromised could also correspond to customers' home addresses. The company notified affected individuals that the leak could lead to unwanted telephone contact, including telemarketing and fraud attempts, and that there is a risk of illegal use of the data for phishing or creation of fake websites.

In response, the company secured access to its IT systems, identified and blocked the source of the unauthorized access, and reported the incident to the President of the Office for Personal Data Protection. The company also indicated that it had contacted its legal office for further handling of the matter. The company declared its intention to prevent similar incidents in the future. The notification was dated 21 May 2025 and was sent via email to the affected customers. The company provided a dedicated email address ([email protected]) for reporting any suspected misuse of the leaked data. The company stated that it had taken all necessary formal steps in connection with the incident.

Sources

Sources available to members: 2 sources.