Patryk Korzeniowski
Introduction: Scale of the Problem
In today's digital economy, where online shopping is commonplace, we store our personal and financial data in numerous places. Online stores, sales platforms, and various e-commerce services constantly process information such as:
• First and last name
• Home address
• Email address, phone number
• Payment card or bank account details
• Account passwords
• Shopping preferences and much more
The e-commerce industry is a tempting target for cybercriminals because the data collected is valuable and can be used for criminal purposes, such as credit fraud or identity theft. As a result, we increasingly hear about major data breaches, and the risk grows due to configuration errors, outdated systems, or social engineering attacks.
Most Common Causes of Data Breaches
System Security Vulnerabilities
Outdated software, poorly configured servers, or lack of updates often open doors for hackers.
Phishing Attacks
Fraudsters extract passwords and authentication data from service employees, customers, and even administrators. They use fake emails, SMS messages, and messaging apps.
Human Factor
Errors or bad practices by employees (carelessness with passwords, lack of 2FA authentication) are one of the main sources of leaks.
Lack of User Awareness
Using simple, repetitive passwords, clicking on suspicious links, or sharing sensitive data via email is a direct path to account takeover.
Most Vulnerable Data and Consequences of Theft
Personal Data
National ID numbers, identity documents: enable identity theft and taking out loans in someone else's name.
Financial Data
Card numbers, bank accounts: can be used for unauthorized payments or even transfers.
Logins and Passwords
Account takeover (e.g., in a store, on an auction site), resulting in purchases on someone else's account or further attacks.
Contact Data
Emails and phone numbers are used for phishing campaigns or account theft (e.g., using fake payment links).
Examples of Major Breaches in Polish E-commerce
Empik (2020)
In May 2020, there was unauthorized access to a database that stored customer names, email addresses, and password hashes. Empik recommended an urgent password change.
Morele.net (2018)
A hacker attack resulted in the leak of data from up to several million customers, including names, addresses, and phone numbers. Customers were later targeted by phishing campaigns.
iTaxi (2020)
Unauthorized access to customer and driver data (email addresses, phone numbers, ride details). The company implemented additional security measures.
OLX
Although one massive leak from the main database has not been confirmed, the platform is exposed to numerous incidents related to phishing and account takeovers through fake messages and links.
How to Protect Your Data from Breaches: Best Practices
Although users don't have direct influence over the security measures implemented by platforms, they can take several actions to reduce the risk of having their most valuable information compromised.
Monitoring Data Breaches
An important element of protection is regularly checking if your data has been leaked in the past. You can do this using the Have I Been Pwned service:
1. Visit haveibeenpwned.com
2. Enter your email address in the search
3. Check which data breaches it appeared in
4. Enable notifications for future breaches for your address
If your data appeared in any of the breaches, immediately change passwords on those services and all other places where you used the same password.
Strong and Unique Passwords
• Uniqueness: don't use the same password across multiple services
• Complexity: minimum 12-16 characters, different types of characters
• Password manager: use tools for secure storage
Two-Factor Authentication (2FA)
• Authentication apps (Google Authenticator, Authy)
• SMS as a backup option
• Hardware keys for the highest security
Data Minimization
• Use pseudonyms when possible
• Fill in only required form fields
• Delete unused accounts
Secure Payments
• Use virtual cards
• Prefer cash on delivery
• Check HTTPS certificates
What to Do After a Breach? Quick Response Plan
Immediate reaction is crucial!
When you learn about a breach (e.g., from a store notification, media, or notifications from services like Have I Been Pwned), take immediate actions described below.
Password Changes and Account Verification
• Change passwords on all related services
• Enable two-factor authentication (2FA)
• Check login history and activities
Document Blocking
• Blocked Documents System
• Block your ID number in government apps
• Notify your bank
Credit Bureau Monitoring
• Activate credit bureau alerts
• Check entries in credit information bureaus
• Regular monitoring of changes
Reports to Institutions
• Data Protection Authority
• Police (in case of crime)
• Consumer Rights Ombudsman
Summary
The increasing number of data breaches in e-commerce doesn't mean we are completely helpless against them. By applying good practices – unique passwords, 2FA, using temporary data, ordering deliveries to parcel lockers – we limit the amount of private information that falls into the hands of stores. Thus, the risk and potential losses in case of a breach are much smaller.
When an incident does occur, a quick reaction is essential: changing passwords, blocking ID documents or national identification numbers, activating alerts in credit bureaus, and informing the appropriate institutions. This way, you protect yourself from more serious consequences, such as identity theft or someone taking out a loan in your name.
Let's also remember that education and awareness remain the key to security – it's worth sharing proven methods with family and friends so that they too can avoid risky behaviors online. This way, we will all be better protected in the world of digital threats.
