MEO Data Breach

What happened?

In early 2023, a corpus of data sourced from the New Zealand based face mask company MEO was discovered. Dating back to December 2020, the data contained over 8k customer records including names, addresses, phone numbers and passwords stored as MD5 Wordpress hashes. MEO did not respond to multiple attempts to report the breach.

When did it happen?

The breach date in the public record is December 24, 2020. The record was added to the catalogue on April 24, 2023 and last updated there on April 24, 2023.

What information was reported as exposed?

• Email addresses
• Names
• Passwords
• Phone numbers
• Physical addresses
• Purchases
• Usernames

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with MEO or used meoair.com around December 24, 2020. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.