MEO Data Breach (2020): What Was Exposed & What To Do

What happened

The incident involves a corpus of customer data attributed to MEO that was identified in early 2023. The records date to December 2020 and include more than 8,000 entries. Passwords appear in the form of MD5 hashes associated with a WordPress installation. No official statement from MEO has been recorded, and the company did not reply to multiple notifications about the data set.

How a breach like this happens

Incidents involving customer databases from online retailers commonly begin with unauthorised access to web servers or content-management systems. Attackers may exploit unpatched software, weak administrative credentials or third-party plugin vulnerabilities. Once inside, they can copy tables that store account details and transaction history. The resulting files are sometimes later posted or traded, allowing the data to appear in public repositories months or years after the initial access.

Who is MEO?

MEO is a New Zealand company that sells face masks directly to consumers. Organisations of this type routinely collect names, delivery addresses, telephone numbers and payment-related information to process orders and manage accounts. A compromise at such a firm is consequential because the data can be used to target individuals through channels they already use for everyday transactions.

The information in question

The exposed records contain the following categories of information:

• Email addresses
• Names
• Passwords stored as MD5 hashes
• Phone numbers
• Physical addresses
• Purchases
• Usernames

Exact confirmation of every field present in the full corpus remains limited to what has been observed in the discovered data set.

The real-world impact

Individuals whose records appear may receive unsolicited messages that reference their purchase history or attempt to reuse the disclosed credentials on other sites. Because the passwords are hashed with MD5, offline cracking attempts become feasible if the hashes are obtained. For the organisation, the incident highlights gaps in monitoring and incident-response procedures that allowed the data to remain unaddressed for more than two years after the records were created.

Were you affected?

Check whether your email address appears in known breach data sets through a free exposure scan offered by services that aggregate public breach listings. If your details are listed, change any reused passwords, enable multi-factor authentication on accounts that support it, and monitor statements from financial institutions for unusual activity. MEO has not published an official notification channel for affected customers.

AICompiled with AI assistance from public sources and published under our editorial standards.