Lazada RedMart redmart.lazada.sg Lazada RedMart data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In July 2020, Lazada's RedMart grocery service had about 1.1 million customer records stolen: email addresses, names, phone numbers, physical addresses, partial credit card numbers and SHA-1 password hashes.
View all 13,118 breaches- Breach date
- 30 Jul 2020
- Affected
- 1,107,789
- Data exposed
- Email addresses, Names, Partial credit card data, Passwords, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
RedMart is Lazada's online grocery service in Singapore. Have I Been Pwned (HIBP) dates the breach to 30 July 2020 and added it on 10 November 2020. News broke in October 2020 of a database offered for sale on an online marketplace, with records as recent as July 2020. It held about 1.1 million customer records.
Lazada's spokesperson said the RedMart data was more than 18 months out of date and not linked to any Lazada database. BleepingComputer reported that the seller said the records included registrations from May and July 2020, which conflicts with that claim. Lazada said it blocked access to the database, told Singapore's data protection regulator, and asked affected customers to create new passwords.
Sources checked: haveibeenpwned.com, bleepingcomputer.com
Last verified against the official page:
What was exposed
HIBP lists email addresses, names, partial credit card data, passwords, phone numbers and physical addresses. Passwords were stored as SHA-1 hashes, an old method that is fast to crack.
What it lets criminals do
A name, phone number and delivery address together make delivery and refund scams believable. Partial card numbers alone can't be used to pay, but scammers use them to sound like your bank.
What to do
Change any password you reused from RedMart, and treat delivery or refund messages with caution.
What to do if you were in it
- 1
Change your password, and any you reused
If you used your RedMart password anywhere else, change it there too. A password manager makes unique passwords easy. Turn on two-factor login where you can.
- 2
Expect phishing that mentions the breach
Treat emails, texts and calls that quote your name, phone number or address as suspect. Don't click links in them; go to the company's site yourself.
- 3
Watch for fake delivery and refund messages
Go to the Lazada or RedMart app yourself rather than tapping links in texts about orders or refunds.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the RedMart breach?
Look up your email on Have I Been Pwned or run a free Serus scan. HIBP lists about 1.1 million customers.
What was exposed?
Email addresses, names, phone numbers, physical addresses, partial credit card numbers and passwords stored as SHA-1 hashes.
Should I change my password?
Yes, if you used your RedMart password anywhere else. Change it there too and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
