James Data Breach (2020): What Was Exposed & What To Do

Data breaches involving customer records from online services continue to surface regularly, often months after the initial compromise. In this case, records from the Brazilian delivery service James were offered for sale in June 2020, with the underlying incident dated to March 2020 and affecting 1.5 million unique email addresses along with associated location and password data.

The exposure is one of several previously undisclosed incidents that appeared together on underground markets. Details were later shared with Have I Been Pwned via dehashed.com, allowing individuals to check whether their information was included.

Inside the incident

The breach occurred in March 2020. In June 2020 the data set was listed among fourteen previously undisclosed breaches offered for sale. The records contained 1.5 million unique email addresses, geographic locations expressed as latitude and longitude pairs, and passwords stored as bcrypt hashes. No further technical details about the method of access or the exact volume of files have been made public.

How a breach like this happens

Incidents affecting online service providers commonly begin with the exploitation of exposed administrative interfaces, weak or reused credentials, or unpatched software components. Once initial access is obtained, attackers may extract database tables containing user account information before the activity is detected. In many cases the first public indication of the event is the appearance of the data on underground forums rather than an announcement from the affected organisation.

James and its sector

James operates as a delivery service in Brazil, connecting customers with couriers through a digital platform. Organisations in this sector routinely collect email addresses for account management and communications, precise location data to coordinate pick-ups and deliveries, and passwords to secure user accounts. A compromise of this data set therefore touches both operational records and personal identifiers that users rely on across multiple services.

What was likely exposed

The facts released with the data set list email addresses, latitude and longitude pairs, and bcrypt-hashed passwords. Organisations of this type also typically store names, phone numbers, order histories and payment references, yet the precise additional fields present in this incident remain undisclosed. Individuals should therefore treat any account they created with James as potentially affected until further confirmation is provided.

The real-world impact

Email addresses combined with location coordinates can support targeted phishing or physical reconnaissance. Bcrypt-hashed passwords require significant computational effort to crack, but any that were weak or reused across sites increase the chance of account takeover elsewhere. For the organisation, the incident adds to the cumulative record of customer data now circulating beyond its control, which may affect future regulatory scrutiny and user trust.

What to do if you're exposed

Change the password on any James account and on any other service where the same password was used. Enable multi-factor authentication wherever available and monitor email accounts for unexpected login attempts or password-reset messages. Readers can run a free exposure scan of their email address against known breach data sets to determine whether their information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.