Lazada RedMart Data Breach (2020): What Was Exposed & What To Do

What is known is that a dataset associated with Lazada RedMart, containing records for 1.1 million customers, appeared for sale on an online marketplace in October 2020. The records included information current as of July 2020. Public reporting on the incident began around July 30, 2020, and the material was described as customer data from the company’s operations. The practical stakes for the people whose information may be involved are straightforward. Email addresses, names, phone numbers and physical addresses can be used for targeted phishing or unwanted contact. Partial credit card details combined with other identifiers can aid attempts at account takeover or fraud. Passwords stored as SHA-1 hashes, if cracked, could allow access to other accounts where the same credentials were reused.

What happened

News of the incident surfaced in October 2020 when the dataset was offered for sale on an online marketplace. The material was reported to contain 1.1 million records with customer email addresses, names, phone numbers, physical addresses, partial credit card numbers and passwords stored as SHA-1 hashes. The records extended to activity as recent as July 2020. No official statement from the company detailing the method or exact timing of the incident has been referenced in the available reporting.

How a breach like this happens

Incidents involving the exposure of customer databases from online retailers commonly begin with unauthorised access to internal systems. Attackers may exploit vulnerabilities in web applications, compromised credentials of staff or third-party vendors, or misconfigured storage that leaves data accessible. Once obtained, the data is often packaged and offered for sale on forums or marketplaces rather than used directly by the initial intruder. The presence of hashed passwords indicates the material was taken from a customer database rather than intercepted in transit.

Lazada RedMart and its sector

Lazada RedMart operates as an online grocery and retail platform serving customers in several Southeast Asian markets. Companies in this sector routinely collect and store names, contact details, delivery addresses and payment information to process orders and manage accounts. Because these platforms handle recurring transactions and maintain long-term customer profiles, the datasets they hold can remain valuable for extended periods after any initial compromise.

What was likely exposed

The reported dataset explicitly included email addresses, names, phone numbers, physical addresses, partial credit card numbers and passwords stored as SHA-1 hashes. Exact confirmation of every field present in the full 1.1 million records has not been independently verified beyond the marketplace listing. Organisations of this type typically also retain order histories and account creation dates, but those elements were not named in the available description of the exposed material.

Why it matters

For individuals, the combination of contact details with partial payment information raises the possibility of increased phishing attempts or attempts to exploit reused passwords on other sites. Partial credit card data alone is usually insufficient for direct fraud, yet when paired with names and addresses it can support more convincing social-engineering attacks. For the organisation, the incident adds to the record of retail-sector exposures and may prompt regulatory scrutiny or requirements to improve data-handling practices.

What to do if you're exposed

Anyone who used Lazada RedMart around or before July 2020 should treat their account password as potentially compromised and change it, along with any other accounts that share the same password. Enable multi-factor authentication where available and monitor bank or card statements for unusual activity. Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in this or other documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.