MSI data breach: 249K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2025-01-17
In July 2024, MSI inadvertently exposed hundreds of thousands of customer records related to RMA claims that were subsequently found to be publicly accessible. The data included 250k unique email addresses alongside names, phone numbers, physical addresses and warranty claims. When contacted about the incident, MSI advised that "there is no evidence the information was ever accessed" and that "the security incident we had did not trigger state data breach notification obligations" due to the absence of "(social security number, driver's license number….etc)". Exposed data: email addresses, names, phone numbers, physical addresses, warranty claims. The breach dates from Jul 7, 2024; Have I Been Pwned loaded it on Jan 17, 2025.
What to do
- If you had a MSI account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
