Mastercard Priceless Specials Data Breach (2019): What Was Exposed & What To Do
SourceBreach data provided in part by Have I Been Pwned, used under CC BY 4.0.
The Mastercard Priceless Specials Data Breach (2019) (reported August 20, 2019) exposed Email addresses, IP addresses, Names and Partial credit card data belonging to roughly 89K people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
What happened
In August 2019 the German Mastercard bonus program known as Priceless Specials suffered a data breach. Records containing personal information on 89,000 members were made available online. The exposed fields included names, email addresses, IP addresses, phone numbers, salutations and partial credit card data. After the incident became known, the program was suspended.
How a breach like this happens
Incidents involving the exposure of customer records from online platforms often begin with unauthorised access to a web application or database. Attackers may exploit configuration errors, unpatched software or weak authentication controls to reach stored data. Once obtained, the information can be copied and distributed through various online channels without the organisation’s knowledge or consent. The precise method used in any individual case remains a matter for investigation by the affected organisation and relevant authorities.
About Mastercard Priceless Specials
Mastercard Priceless Specials operated as a customer rewards programme in Germany, allowing participants to earn and redeem benefits linked to Mastercard card usage. Programmes of this type routinely collect contact details, account identifiers and limited payment information to manage enrolment, deliver offers and process redemptions. A breach at such a service therefore touches data that participants provide in the ordinary course of joining a loyalty scheme.
The information in question
The records that circulated included email addresses, IP addresses, names, phone numbers, salutations and partial credit card data. The exact scope of every field present in the circulated files has not been independently verified beyond these categories. Organisations that run rewards programmes commonly store similar information to operate their services; whether additional categories were involved remains unconfirmed.
Why it matters
Exposure of names, contact details and partial payment information can enable unsolicited contact and increase the chance of targeted phishing attempts. Partial credit card data, when combined with other details, may assist in fraudulent activity even if full card numbers and verification codes are absent. For the organisation, the incident led to suspension of the programme and required notification and remedial steps under applicable data-protection rules.
Were you affected?
Individuals who participated in the Priceless Specials programme can review any communications they received from Mastercard or the programme operator after August 2019. Checking email accounts for unexpected messages and monitoring statements for unusual activity provides an immediate practical step. A free exposure scan of an email address against known breach data sets can indicate whether the address has appeared in publicly discussed incidents.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
BtoBet Data Breach (2019)IndiHome Data Breach (2019)Data Enrichment Exposure From PDL Customer Data Breach (2019)The Halloween Spot Data Breach (2019)Latest breaches
Read GalaxyWarden’s full analysis of the Mastercard Priceless Specials Data Breach (2019) →
Verified breach. Breach data provided in part by Have I Been Pwned, used under CC BY 4.0.
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.