Temu refutes data breach allegations by unknown threat actor trying to profit

Temu, a popular e-commerce marketplace, says that not a single line of data disseminated by an unknown threat actor matches its real records.

An unknown threat actor on the illicit marketplace BreachForums is looking for a buyer for what it claims to be 87 million lines of Temu users’ personal data. Temu, however, assures users that their data is safe.

The claims about the alleged Temu breach were posted on September 16th by a new account dubbed “smokinthashit.” It has no previous track records of data breaches, yet claims to have obtained 87 million lines of personal data and is trying to sell it to “only serious people and not timewasters.”

The sample provided includes full names, IP addresses, physical addresses, emails and other personal information. However, Cybernews researchers noted that IP location and address location for the same users do not match, and are often from different countries.

“Temu's security team has conducted a comprehensive investigation into the alleged data breach and can confirm that the claims are categorically false; the data being circulated is not from our systems. Not a single line of data matches our transaction records,” a Temu spokesperson told Cybernews.

Temu says that the security and privacy of our users are paramount.

“We follow industry-leading practices for data protection and cybersecurity, ensuring that consumers can shop with peace of mind on our platform,” the spokesperson added.

“We take any attempt to tarnish our reputation or harm our users extremely seriously and reserve the right to pursue legal action against those responsible for spreading false information and attempting to profit from such malicious activities.”

The company also noted that its security commitment is demonstrated by its MASA certification from DEKRA, partnership with HackerOne for vulnerability identification, implementation of Two-factor Authentication, membership in the Anti-Phishing Working Group, and adherence to PCI DSS standards for payment security.