E-commerce company Lazada, which operates mainly in Southeast Asia, has suffered a data breachthat has affected a large number users .
Lazada's security team discovered a breach on Thursday in a customer database of RedMart , the online goods delivery service. The Alibaba -owned company said the stolen information, contained in a database that was at least 18 months old.
According to Lazada, the database was used by the now-defunct RedMart app and website and was hosted by a third-party service provider
Lazada bought RedMart in late 2016 and last March, it integrated the goods delivery service into its own app.
According to Channel News Asia , which first reported the incident, the database details are being offered for sale on an illegal forum and include names, phone numbers, emails and passwords from various e-commerce websites around the world.
CNBC was unable to independently verify the content of the online forum. However, Lazada confirmed to CNBC that the personal information of 1.1 million RedMart accounts was leaked.
Affected users were logged out of their existing accounts and asked to reset their password before logging in. Lazada also said it blocked access to the database immediately.
The company said it had reported the incident to the Data Protection Commission . Under the law, companies are required to notify the commission and affected individuals in the event of a data breach if it involves the personal data of 500 or more individuals.
On its website, Lazada said that the affected database was not connected to any of its current databases.
As more people turn to online shopping, following the coronavirus pandemic, the risk to their data security is increasing.
