Shopper+ Data Breach (2020): What Was Exposed & What To Do

In 2023, Shopper+ disclosed that customer records dating back to September 2020 had appeared on a public hacking forum. The incident involved 878,000 records containing names, email addresses, physical addresses, phone numbers, and in some cases genders and dates of birth. People whose information was included now face the possibility that their details have circulated beyond the company’s control for more than two years.

The disclosure highlights how long personal data can remain exposed before an organisation learns of or reports an incident. For affected individuals, the practical concern is the potential use of this information for unsolicited contact, account takeovers, or more targeted misuse.

Breaking down the breach

Shopper+ stated that the breach originated in September 2020. The company reported the matter in March 2023 after the data appeared on a public forum. The records totalled 878,000 and included email addresses, physical addresses, names, phone numbers, and, for some individuals, genders and dates of birth. No further technical details about the initial access method or the volume of data taken have been released publicly.

How a breach like this happens

Incidents involving customer databases often begin with unauthorised access to an organisation’s systems through compromised credentials, unpatched software, or misconfigured storage. Once obtained, the data may be copied and later posted or sold on forums where multiple parties can view or acquire it. In many cases, the organisation only becomes aware after the material surfaces publicly or is reported by third parties.

Who is Shopper+?

Shopper+ operates as an online retail platform, sometimes described as Canada’s online shopping mall. Like similar e-commerce services, it collects and stores customer information required for order processing, shipping, and account management. A breach at such a company is consequential because the records typically contain the precise details needed for everyday transactions and communications.

The information in question

The disclosed records contained dates of birth, email addresses, genders, names, phone numbers, physical addresses, and spoken languages. These categories were listed in the company’s notification. The precise scope of each record and whether additional fields were present remain unconfirmed beyond the published summary.

What's at stake

Names combined with physical addresses and phone numbers can be used to create more convincing phishing messages or to attempt account recovery on other services. Dates of birth add another element that some organisations use for verification. For the company, the incident creates ongoing obligations around notification, customer support, and potential regulatory review. Individuals cannot change many of the exposed data points, so the exposure may persist.

What to do if you're exposed

Review recent account activity on any services that use the same email address or phone number. Enable multi-factor authentication where available and consider using unique passwords. Monitor statements for unexpected activity and contact your financial institutions if addresses or phone numbers have changed without your action. Readers can run a free exposure scan of their email address to check whether their information appears in known breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.