The shipping industry has become the latest sector to suffer a significant data breach, as Hipshipper, a global shipping platform used by sellers on Amazon, eBay, and Shopify, inadvertently exposed over 14 million records.
The incident, discovered by Cybernews researchers in December 2024, stemmed from an unprotected Amazon Web Services (AWS) storage bucket containing sensitive shipping labels and customs forms. The exposed data remained accessible for at least a month before the security gap was closed in January 2025.
The breach came at a particularly vulnerable time—during the peak holiday shipping season—when millions of packages were in transit worldwide. Hipshipper, which facilitates shipping to over 150 countries with tracking, free insurance, and easy returns, inadvertently made personal customer information publicly available. The leaked data included full names, home addresses, phone numbers, order details, mailing dates, and parcel information.
According to Cybernews researchers, this exposure created a serious security risk. “Cybercriminals can use leaked data to carry out scams and phishing attacks. For example, criminals might pretend to be trusted businesses and send fake messages using specific order details to trick people into sharing personal or financial information,” the researchers noted. While there is no direct evidence that the data was accessed by malicious actors, the nature of the leak makes it an attractive target for cybercriminals who use automated bots to search for exposed information online.
The potential consequences of this breach extend beyond compromised personal data. Attackers could use the exposed information to craft sophisticated social engineering attacks, impersonating shipping carriers or online retailers to defraud unsuspecting victims. Given the widespread reliance on Hipshipper for international logistics, the breach underscores the growing cybersecurity challenges facing the retail and e-commerce industries.
This incident is part of a broader trend of increasing data breaches across multiple sectors. In recent months, major retailers and service providers, including Grubhub, Mizuno, and Hot Topic, have also suffered security lapses, highlighting the vulnerability of even well-established companies. Cybersecurity experts warn that businesses must adopt stricter data protection measures, particularly when handling sensitive customer information stored in cloud-based environments.
