Huge data leak exposes 14 million customer shipping records

No industry is safe from data breaches. Over the past few months alone, we've seen security incidents hit almost every sector, including healthcare, finance and tech. Now, the shipping industry has joined the list, with a major global shipper that works with Amazon, eBay and Shopify exposing 14 million records.

To make things worse, the open instance was found in December during the peak of international shipping when people are sending and receiving gifts all over the world. Researchers traced it back to an unprotected AWS bucket owned by Hipshipper.

However, an unprotected AWS bucket held over 14.3 million records, mainly shipping labels and customs forms. Researchers from Cybernews said, "Cybercriminals can use leaked data to carry out scams and phishing attacks. For example, criminals might pretend to be trusted businesses and send fake messages using specific order details to trick people into sharing personal or financial information."

Researchers believe the exposed bucket contained sensitive information about buyers, including their full names, home addresses, phone numbers and order details such as mailing dates and parcel information. While there's no direct evidence that cybercriminals accessed the exposed data, millions of malicious actors use automated bots to search the internet for similar leaks, hoping to find data they can use for harmful purposes. 

2) Watch out for snail mail: While many security threats happen online, physical mail can also be a target. With home addresses exposed in data leaks, criminals may send fraudulent letters or fake invoices to trick you into providing further personal information or making payments. If you receive suspicious mail, avoid responding and report it to the company it claims to be from.

5) Monitor your credit reports regularly: You can request free credit reports from major credit bureaus to check for any suspicious activity or unauthorized accounts opened in your name.

It's high time every industry took cybersecurity seriously. If your business operates online, you are just as responsible for protecting customer data as a tech company, possibly even more so, since tech companies typically have stronger safeguards in place. The fact that Hipshipper left a storage bucket containing 14 million records unprotected speaks volumes about how little they prioritize cybersecurity. And it's not just Hipshipper. Many companies dealing with tech products aren't even careful enough to password-protect their critical documents. This lack of basic security highlights a worrying trend across industries.

Follow Kurt on his social channels:

Answers to the most-asked CyberGuy questions:

New from Kurt:

Copyright 2025 CyberGuy.com. All rights reserved.