The security team at Safety Detectives, currently led by Anurag Sen, discovered a significant data breach, including personally identifiable information, belonging to Brazilian retailer Natura & Co.
The leaked database was hosted on an Amazon server, located in the U.S., says the Safety Detectives report. "Strangely, since the data leak was discovered and Natura being informed, the size of the data leak has been reduced from 272GB to 27.2GB, according to server logs — this is a strong indication of purposeful impropriety aimed at concealing the severity of the leak. For example, an ill-intentioned hacker removing a precise number of records to conceal their actions. Moreover, according to server logs, the size of the data breach has varied over the course of several days with the latest estimate showing 69GB," says the security team.
Around 90 percent of users were Brazilian customers although other nationalities were also present including customers from Peru.
Safety Detectives says that at least 250,000 customers were affected, in addition to 40,000 wirecard.com.br - a third-party company that facilitates online payments for Natura - MoIP account details with access tokens. In specific, the records contained:
- Full name
- Mother’s maiden name
- Date of Birth
- Nationality
- Gender
- Natura.com.br login credentials including hashed passwords
- Welcome email template
- Username and nickname
- MoIP account details
- API credentials including unencrypted passwords
- Previous purchases
- Telephone number
- Email and physical addresses
- Access token for wirecard.com.br
For more information about the data breach, please visit https://www.safetydetectives.com/blog/natura-leak-report/
