Money Bookers Data Breach (2009): What Was Exposed & What To Do

In 2009 an e-wallet service then known as Money Bookers experienced a data breach that exposed records belonging to approximately 4.5 million customers. The incident remained undetected for several years and only came to wider attention in October 2015, long after the company had been rebranded as Skrill. Public records list the affected information as names, email addresses, dates of birth, phone numbers, physical addresses and IP addresses. The breach occurred at a time when online payment platforms were expanding rapidly and storing growing volumes of personal and financial identifiers. Its late discovery illustrates how undetected intrusions can persist across corporate changes and rebrandings.

Breaking down the breach

The available facts state that the intrusion took place sometime in 2009 and affected roughly 4.5 million customer records. No information has been released about the method of access, the duration of unauthorised presence inside the network, or any files that may have been copied. The breach was not identified until October 2015. No dollar figures, attacker claims or internal investigation findings have been made public.

How a breach like this happens

Incidents involving large customer databases at payment or financial-service companies often begin with the compromise of an internet-facing server or an internal system that holds user records. Attackers may exploit unpatched software, weak authentication, or stolen credentials to reach the data store. Once inside, they can copy tables containing names, contact details and account metadata without immediately triggering detection. In many cases the organisation only learns of the event when the data later appears on public forums or when external researchers notify the company.

Who is Money Bookers?

Money Bookers operated an electronic wallet service that allowed users to send and receive payments online. Such platforms routinely collect and retain personal identifiers, contact information and transaction metadata to comply with regulatory requirements and to manage accounts. The company was later renamed Skrill. A breach at an organisation of this type is consequential because the data it holds can be used for targeted phishing, identity misuse or further attacks against the same individuals at other services.

What data was at risk

The records listed in connection with the incident include names, email addresses, dates of birth, phone numbers, physical addresses and IP addresses. It is not confirmed whether additional categories such as passwords, payment card details or transaction histories were also exposed. Organisations in this sector typically store enough information to verify customer identity and process payments; however, the precise contents of the 2009 dataset remain unconfirmed beyond the fields already named.

What's at stake

Individuals whose records were involved face the possibility that their contact details and identifiers could be used for unsolicited messages or more targeted attempts to compromise other accounts. For the organisation, the incident created long-term reputational and regulatory exposure once it became public years after the event. Because the breach went unnoticed for an extended period, it is difficult to determine how the data may have been used in the intervening years.

Were you affected?

Anyone who held a Money Bookers account before or during 2009 may wish to review statements from Skrill and monitor their email and postal addresses for unusual activity. A practical first step is to change passwords on that account and any other services that reuse the same credentials. Readers can also run a free exposure scan of their email address against known breach data to check whether their information appears in publicly discussed datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.