Ster-Kinekor Data Breach

What happened?

In 2016, the South African cinema company Ster-Kinekor had a security flaw which leaked a large amount of customer data via an enumeration vulnerability in the API of their old website. Whilst more than 6 million accounts were leaked by the flaw, the exposed data only contained 1.6 million unique email addresses. The data also included extensive personal information such as names, addresses, birthdates, genders and plain text passwords.

When did it happen?

The breach date in the public record is March 9, 2017. The record was added to the catalogue on March 13, 2017 and last updated there on March 13, 2017.

What information was reported as exposed?

• Dates of birth
• Email addresses
• Genders
• Names
• Passwords
• Phone numbers
• Physical addresses
• Spoken languages

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with Ster-Kinekor or used sterkinekor.co.za around March 9, 2017. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.