Kind Oal: unauthorized access to an e-commerce platform staff account

On 24 August, used designer clothing retailer Kind Oal noticed that the email address of a staff account on its e-commerce platform had been changed. The platform operator found that a third party had logged in and exported customer data in bulk twice on 23 August. The staff member had entered the account credentials on a fake site linked from a phishing email posing as the platform operator; the account had no two-factor authentication and a weak password. Names, addresses, phone numbers, birth dates, emails, order counts and totals, and point histories of 136,464 people leaked. Card data and login passwords were not included. Its October 13 third report confirmed 136,464 affected people, including 109,311 whose address information was included.