[BreachExchange] Ikea says sorry for customer data breach

[Destry Winant]

https://www.straitstimes.com/singapore/ikea-says-sorry-for-customer-data-breach

Swedish retailer Ikea yesterday apologised to affected customers in
Singapore after the company inserted 410 individual e-mail addresses
in the wrong message field of a promotional mailer and sent it out.

A spokesman for Ikea Singapore said the incident occurred at 4.57pm
last Thursday and that it "regretfully made an error of inserting 410
individual e-mail addresses in the 'To' field in an Ikea service
delivery promotion e-mail sent to our customers", making the e-mail
addresses visible to all recipients of the mailer.

However, the second e-mail it sent to quickly notify affected
customers about the leak and to apologise included an internal draft
of the apology instead.

"In our haste to notify the custo-mers as quickly as possible, we
again made a mistake by sending half the recipients an internal draft
of the apology notice instead, an oversight that we are embarrassed
about," Ikea said.

Ikea said it takes customers' personal data integrity seriously and
has notified the Personal Data Protection Commission of Singapore
(PDPC).

Under the Personal Data Protection Act, organisations must generally
have an individual's knowledge and consent when collecting, using or
disclosing their personal data.

Last month, international beauty retailer Sephora issued a notice to
its online customers after it discovered a data breach affecting
customers in Singapore, Malaysia, Indonesia, Thailand, the
Philippines, New Zealand and Australia.

Electricity retailer Geneco was probed by the PDPC last month after it
exposed the e-mail addresses of more than 350 of its potential
customers.