Weee sayweee.com Weee data breach: what happened and what to do
In February 2023 data from the grocery delivery service Weee surfaced, dating to mid-2022. HIBP counts about 1.1 million unique email addresses, with names, phone numbers, delivery instructions and purchases. Weee says passwords and payment data weren't involved.
View all 13,115 breaches- Breach date
- 11 Jul 2022
- Affected
- 1,117,405
- Data exposed
- Delivery instructions, Email addresses, Names, Phone numbers, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Weee, the Asian and Hispanic grocery delivery service, confirmed a data breach in February 2023 after its customer data was posted online. The data dated back to mid-2022. Have I Been Pwned (HIBP) found 1,117,405 unique email addresses in 11 million rows of orders.
What was exposed
HIBP lists email addresses, names, phone numbers, purchases and delivery instructions. BleepingComputer reported that some delivery notes included codes to get into residential or office buildings. The attacker claimed a larger number of records, but the extra rows are mostly repeat orders from the same customers.
What this means for you
A name, a phone number and what you ordered is plenty for a convincing scam text posing as a delivery update. Building access codes are a separate issue: if you left one in a note, change it if you can, or tell your building manager.
The company's response
Weee said it doesn't keep customer payment information in its databases, and that account passwords weren't compromised. It notified affected customers individually.
What to do if you were in it
- 1
Expect phishing that uses real details
With your name, phone number and order history in circulation, scammers can send emails or texts that look personal. Don't click links in unexpected messages, and go to the company's site directly instead.
- 2
Change any door or gate code you put in a note
Delivery instructions sometimes held entry codes. If you shared one, ask your building to change it, and keep codes out of order notes in future.
- 3
Treat delivery texts with care
A text about a missed Weee delivery that asks for a payment or a login is a scam. Check orders in the app.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak.
Frequently asked
Was I affected by the Weee breach?
HIBP lists 1,117,405 unique email addresses. If you ordered in 2022, check your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the Weee breach?
Email addresses, names, phone numbers, purchases and delivery instructions. Weee says passwords and payment data weren't affected.
Should I change my password after the Weee breach?
Weee says passwords weren't compromised, so it isn't required. Changing it is still a sensible habit if you reuse it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
