Durex India, the local branch of the British condom and personal lubricants brand, has experienced a significant data breach, revealing sensitive customer information.
Security researcher Sourajeet Majumder alerted TechCrunch to the issue, which involves exposed data including customers’ full names, phone numbers, email addresses, shipping addresses, and order details.
Majumder discovered that hundreds of customers were affected due to inadequate security measures on the brand’s order confirmation page. Although the precise number of individuals impacted is unclear, the researcher highlighted the gravity of the situation, given the intimate nature of the products involved.
Reckitt, the parent company of Durex, has yet to provide a comment or outline any steps to secure the compromised information. Majumder expressed concern that the leaked data could facilitate identity theft and lead to unwanted harassment. He also notified India’s Computer Emergency Response Team (CERT-In), which acknowledged his report.
Majumder warned that the breach could result in not only identity theft but also social and moral harassment of the affected individuals.
“A research conducted by me shows that @DurexIndia is leaking order details of it’s customers including names, number/email, shipping address, ordered items and the amount paid due to a security misconfiguration in their order confirmation page,” researcher posted on X.
“A leak as such not only puts the customer’s privacy at risk but also makes them prone to social harassment or moral policing.”